CVE-2026-25049: n8n Expression Sandbox Escape Enables RCE

CVE-2026-25049 is an expression sandbox escape in n8n that can allow authenticated users to execute system commands on the underlying host, a vulnerability described as a post-auth issue with potential access to stored credentials, internal services and webhook-triggered workflows. According to the GitHub advisory cited in the article, all versions below 1.123.17 are affected, and in the 2.x line, from 2.0.0 up to (but not including) 2.5.2.

Exploitation involves bypassing n8n’s expression restrictions to regain access to powerful JavaScript/Node.js primitives, with multiple documented paths such as type confusion and alternative equivalent operations that circumvent denial patterns. Public reporting has not confirmed in-the-wild exploitation, but defenders are urged to patch promptly.

Upgrade to n8n 1.123.17+ (1.x) or 2.5.2+ (2.x), or, on the 2.4 branch, to 2.4.5+; if patching isn’t immediate, restrict workflow creation/editing to trusted users and harden runtime permissions. According to SOCRadar Cyber Intelligence Inc., SOCRadar’s threat intelligence products track CVEs and exploitation chatter to help teams detect real-world risk before vulnerabilities are abused.