n8n 存在 Form 节点中的非身份验证表达式评估漏洞

该漏洞的潜在影响非常严重。攻击者可以利用此漏洞注入并执行任意 n8n 表达式，从而完全控制受影响的 n8n 实例。这可能导致敏感数据泄露、系统配置更改，甚至远程代码执行。为了成功利用此漏洞，攻击者需要特定的工作流配置：一个包含从未经身份验证的用户提供的输入进行插值的表单节点，并且该输入值必须以 = 字符开头。如果结合表达式沙箱逃逸，攻击者可以绕过安全限制，执行任意代码。

Organizations heavily reliant on n8n for workflow automation, particularly those with publicly accessible forms or integrations that accept user-provided input, are at significant risk. Environments with legacy n8n configurations or those lacking robust input validation practices are especially vulnerable. Shared hosting environments where multiple users share the same n8n instance also face increased risk due to the potential for cross-tenant exploitation.

• nodejs / server: Monitor n8n logs for unusual expression execution patterns or errors related to expression parsing. Use journalctl -u n8n to filter for relevant log entries. • nodejs / server: Check for unexpected processes running under the n8n user account using ps aux | grep n8n. • generic web: Inspect n8n access logs for suspicious requests containing = characters in form parameters, particularly those targeting form submission endpoints. Use curl -v <n8nformendpoint> to test for injection. • generic web: Review n8n configuration files for any insecure expression handling practices.

1. 2026-02-25Disclosure

   disclosure

1. 已保留2026-02-19
2. 发布日期2026-02-25
3. 修改日期2026-02-28
4. EPSS 更新日期2026-03-23

缓解此漏洞的最佳方法是立即升级到 n8n 1.123.22 或更高版本。如果无法立即升级，可以考虑以下临时缓解措施：首先，审查所有工作流配置，确保没有以 = 开头的用户输入被插值到表达式中。其次，限制 n8n 实例的访问权限，仅允许必要的用户和系统访问。第三，实施严格的输入验证和清理，以防止恶意表达式注入。最后，监控 n8n 日志，查找任何可疑活动。