n8n: Expression Sandbox Escape Leads to RCE

An attacker exploiting this vulnerability could gain complete control over the n8n server. This includes the ability to install malware, steal sensitive data, and potentially pivot to other systems on the network. The attack vector involves crafting malicious expressions within workflow parameters, which, when evaluated by n8n, trigger the execution of arbitrary system commands. This is similar in concept to previous expression evaluation vulnerabilities in n8n (CVE-2025-68613), highlighting a recurring risk in this area of the application. The blast radius extends to any data processed by the affected n8n instance, as well as any systems accessible from the compromised server.

Organizations heavily reliant on n8n for workflow automation, particularly those with complex workflows or a large number of users with workflow creation/modification privileges, are at significant risk. Shared hosting environments where multiple users share an n8n instance are also particularly vulnerable, as a compromised user could potentially impact other tenants.

• nodejs: Monitor n8n logs for unusual process executions or errors related to expression evaluation. Use ps aux | grep n8n to check for unexpected child processes spawned by n8n. • generic web: Examine n8n access logs for requests containing suspicious characters or patterns in workflow parameter values. Use curl -I <n8n_url>/trigger/http to check for exposed endpoints that could be exploited. • linux / server: Use journalctl -u n8n to filter for error messages or unusual activity related to workflow execution. Implement auditd rules to monitor file access and process creation related to n8n.

1. 2026-02-25Disclosure

   disclosure

1. Reserviert2026-02-20
2. Veröffentlicht2026-02-25
3. Geändert2026-02-28
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-27577 is to upgrade n8n to version 2.10.1, 2.9.3, or 1.123.22 or later. If immediate upgrading is not possible, consider restricting user permissions to prevent users from creating or modifying workflows. This limits the attack surface. Additionally, carefully review existing workflows for any suspicious expressions. While a WAF or proxy cannot directly prevent this vulnerability, it can help detect and block malicious requests. After upgrading, confirm the fix by attempting to create a workflow with a deliberately malicious expression (e.g., a command to list files) and verifying that it is rejected.