CVE-2026-65591: n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution

n8n evaluates {{ }} expressions in workflow fields. The legacy evaluator tries to block dangerous property access by sanitizing computed members, such as obj[expr]. The advisory says this sanitizer can be bypassed. The sources do not publish the bypass payload.

The attacker must be logged in and able to create or edit workflows, which ordinary members can do by default. They put a crafted expression in a workflow field and run it. The expression escapes the sandbox and runs code as the n8n process, with host-level reach.

That means access to everything the process can touch: the credentials n8n stores and decrypts, environment variables, files on disk, and the internal network. On a shared instance, one low-trust member can take over all other users' workflows and secrets. The CVSS 4.0 score is 8.9, with high confidentiality, integrity and availability impact.

The legacy engine is the default in affected versions, so no special setting is needed to be exposed.

The n8n npm package before 1.123.64, from 2.0.0-rc.0 before 2.29.8, and 2.30.0 before 2.30.1. The legacy expression engine is the default in these versions. Instances running the vm engine are the advisory's suggested mitigation.

npm ls n8n

For Docker, check the image tag. Check the environment for N8N_EXPRESSION_ENGINE.

Upgrade to n8n 1.123.64, 2.29.8 or 2.30.1, or later on your release line.

npm install [email protected]

Temporary mitigations from the advisory, which do not fully remediate the risk:

• Restrict instance access to fully trusted users.
• Switch to the non-legacy engine with N8N_EXPRESSION_ENGINE=vm.

If you think an untrusted user had workflow access, rotate stored credentials after upgrading.

The sources give no log signature. Review workflows created or changed by non-admin users for unusual expressions, especially ones using bracket access with computed or concatenated keys. On the host, look for child processes spawned by the n8n process, new files, and outbound connections that do not match your workflows.

Impact

The legacy expression evaluator's computed-member sanitizer can be bypassed by an authenticated user with workflow create or modify permissions. Successful exploitation grants the attacker host-level code execution as the n8n process.

The legacy expression engine is the default engine in affected versions.

Patches

The issue has been fixed in n8n versions 1.123.64, 2.29.8, and 2.30.1. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

• Restrict n8n instance access to fully trusted users only.
• Switch to the non-legacy expression engine by setting N8N_EXPRESSION_ENGINE=vm.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.