Platform
nodejs
Component
n8n
Fixed in
1.123.23
2.0.1
2.10.1
1.123.22
CVE-2026-27493 describes a critical second-order expression injection vulnerability discovered in n8n, a workflow automation platform. This flaw allows an unauthenticated attacker to inject and evaluate arbitrary n8n expressions, potentially escalating to remote code execution (RCE) on the n8n host. The vulnerability impacts versions of n8n prior to 1.123.22 and requires a specific workflow configuration to be exploited. A fix is available in version 1.123.22.
The impact of CVE-2026-27493 is severe due to its potential for remote code execution. An attacker can exploit this vulnerability by crafting malicious form data that includes an expression starting with an equals sign (=). This injected expression is then evaluated by n8n, allowing the attacker to execute arbitrary code on the server hosting the n8n instance. Successful exploitation could lead to complete system compromise, including data theft, modification, or destruction. The vulnerability's reliance on a specific workflow configuration (form node with user-provided input and interpolation) narrows the attack surface somewhat, but the potential for RCE remains a significant threat. The ability to chain this with an expression sandbox escape further amplifies the risk, enabling more direct code execution.
CVE-2026-27493 was publicly disclosed on 2026-02-25. As of this writing, there are no known public exploits or active campaigns targeting this vulnerability. The vulnerability is not currently listed on CISA KEV. The CVSS score of 9 (CRITICAL) indicates a high probability of exploitation if the vulnerability is exposed and exploitable workflows exist. The requirement for a specific workflow configuration may limit the immediate exploitability, but the potential for RCE warrants immediate attention.
Exploit Status
EPSS
0.23% (46% percentile)
CISA SSVC
The primary mitigation for CVE-2026-27493 is to upgrade to n8n version 1.123.22 or later. This version includes a fix that prevents the expression injection vulnerability. If upgrading immediately is not feasible, consider implementing temporary workarounds. Carefully review all workflow configurations, particularly those involving form nodes and user-provided input. Disable or modify workflows that utilize interpolation of user-supplied data, especially if the input is not properly validated. While a direct WAF rule is difficult to implement without deep inspection of n8n’s internal expression parsing, monitoring for unusual expression execution patterns in n8n logs can provide early warning signs of potential exploitation. There are no specific Sigma or YARA rules available at this time, but monitoring for unexpected process execution originating from the n8n process is recommended.
Update n8n to version 2.10.1, 2.9.3, 1.123.22 or higher. If updating immediately is not possible, manually review the use of form nodes for the aforementioned conditions, disable the form node by adding `n8n-nodes-base.form` to the `NODES_EXCLUDE` environment variable and/or disable the Form Trigger node by adding `n8n-nodes-base.formTrigger` to the `NODES_EXCLUDE` environment variable.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-27493 is a critical remote code execution vulnerability in n8n, allowing attackers to inject and execute arbitrary expressions through crafted form submissions.
You are affected if you are running n8n versions prior to 1.123.22 and have workflows configured with form nodes that interpolate user-provided input.
Upgrade to n8n version 1.123.22 or later. Review and secure workflows using user-provided input as a temporary workaround.
As of now, there are no confirmed reports of active exploitation, but the high CVSS score indicates a potential risk.
Refer to the official n8n security advisory on their website or GitHub repository for detailed information and updates.
CVSS Vector
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.