HIGH

GHSA-pm35-fqvh-cq5g

n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution

Quick fix

GHSA-pm35-fqvh-cq5g — n8n: upgrade to the fixed version with the command below.

npm install n8n@1.123.64

Details

## Impact The legacy expression evaluator's computed-member sanitizer can be bypassed by an authenticated user with workflow create or modify permissions. Successful exploitation grants the attacker host-level code execution as the n8n process.

The legacy expression engine is the default engine in affected versions.

## Patches The issue has been fixed in n8n versions 1.123.64, 2.29.8, and 2.30.1. Users should upgrade to one of these versions or later to remediate the vulnerability.

## Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict n8n instance access to fully trusted users only. - Switch to the non-legacy expression engine by setting `N8N_EXPRESSION_ENGINE=vm`.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm / n8n

Introduced in: 0 Fixed in: 1.123.64

Fix npm install n8n@1.123.64

npm / n8n

Introduced in: 2.30.0 Fixed in: 2.30.1

Fix npm install n8n@2.30.1

npm / n8n

Introduced in: 2.0.0-rc.0 Fixed in: 2.29.8

Fix npm install n8n@2.29.8

Details

Are you affected?

Affected packages

References