A new, critical security vulnerability has been discovered in the n8n platform . Successful exploitation could lead to the execution of arbitrary system commands .
The bug, codenamed CVE-2026-25049 (CVSS score: 9.4), is the result of insufficient sanitization, which bypasses security measures that were put in place to address CVE-2025-68613 (CVSS score: 9.9), another critical bug that was patched in December 2025.
“ Additional exploits in n8n expression evaluation have been identified and patched since CVE-2025-68613 ,” n8n administrators said in an advisory released Wednesday
See also: CISA adds SolarWinds WHD vulnerability to KEV List
“An authorized user with permission to create or modify workflows could exploit crafted expressions in workflow parametersto cause unwanted execution of system commands on the host computer running n8n.“.
The issue affects the following versions:
<1.123.17 (Fixed in version 1.123.17)
<2.5.2 (Fixed in version 2.5.2)
As many as 10 security researchers, including Fatih Çelik, who reported the original bug CVE-2025-68613, as well as Cris Staicu from Endor Labs, Eilon Cohen from Pillar Security, and Sandeep Kamble from SecureLayer7, have been credited with discovering the vulnerability.
“An attacker creates a workflow with a publicly accessible webhook that does not have authentication enabled,” SecureLayer7 said . “ By adding a single line of JavaScript, using destructuring syntax, the workflow can be abused to execute system-wide commands. Once exposed, anyone on the internet can trigger the webhook and execute commands remotely .”
Successful exploitation of the vulnerability could allow an attacker to compromise the server, steal credentials, extract sensitive data , and install persistent backdoors to facilitate long-term access.
See also: Hackers exploit Metro4Shell vulnerability in React Native CLI npm package
The cybersecurity firm also noted that the severity of the flaw increases significantly when combined with n8n's webhook feature, allowing an adversary to create a workflow using a public webhook and add a remote code execution payload to a node in the workflow, making the webhook publicly accessible once the workflow is triggered.
Pillar 's report says the issue allows an attacker to steal API keys, cloud provider keys, database passwords, OAuth tokens , and gain access to the file system and internal systems , switch to connected cloud accounts, and hijack AI workflows.
"The attack doesn't require anything special. If you can create a workflow, you can control the server," Cohen said.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Endor Labs, which also shared details of the vulnerability, said the problem stems from gaps in n8n's sanitization mechanisms, which allow security checks to be bypassed.
“ The vulnerability arises from a mismatch between TypeScript’s compile-time type system and JavaScript’s runtime behavior ,” Staicu explained . “ While TypeScript enforces that a property must be a string at compile time, this enforcement is limited to values that exist in the code at compile time .”
“TypeScript cannot enforce these type checks on values generated by attackers at runtime. When attackers create malicious expressions at runtime, they can pass non-string values (such as objects, arrays, or symbols) that bypass the sanitization check entirely“.
See also: Docker fixes critical flaw in Ask Gordon AI
Vulnerability n8n: Protection
If immediate remediation is not possible, users are encouraged to follow the following workarounds to minimize the impact of a potential exploit:
– Restrict workflow creation and editing rights only to fully trusted users.
– Deploy n8n in a hardened environment with limited operating system privileges and network access.
“This vulnerability shows why it is critical to have multiple layers of validation. Even if one layer (TypeScript types) seems strong, additional checks are required at runtime when processing untrusted input,” Endor Labs said. “Pay special attention to sanitization operations when reviewing code.”
