{"id":"EUVD-2026-47635","enisaUuid":"321bbe5c-a6f6-3097-b9f4-5b653b46bb82","description":"n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator\u0027s computed-member handler. An authenticated user with workflow create or modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code execution as the n8n process. The legacy expression engine is the default in affected versions. Fixed in n8n 1.123.64, 2.29.8, and 2.30.1.","datePublished":"Jul 22, 2026, 11:21:40 AM","dateUpdated":"Oct 29, 2026, 9:16:22 PM","baseScore":8.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L","references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-pm35-fqvh-cq5g\nhttps://www.vulncheck.com/advisories/n8n-before-sanitizer-bypass-remote-code-execution\n","aliases":"CVE-2026-65591\nGHSA-m7jc-p4hf-xhwq\nGHSA-pm35-fqvh-cq5g\n","assigner":"VulnCheck","epss":0.69,"enisaIdProduct":[{"id":"07ec74c1-5c15-3b3c-af29-b40759c2c157","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"2.0.0-rc.0 \u003c2.29.8"},{"id":"3830a33a-df55-3245-ab19-2dbbe7bc3a43","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"2.30.0 \u003c2.30.1"},{"id":"d82b5c15-3580-3e3e-93eb-8ab88bbab724","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"0 \u003c1.123.64"}],"enisaIdVendor":[{"id":"24d91081-b01d-3111-8fa5-3a626fc305d5","vendor":{"name":"n8n-io"}}],"enisaIdVulnerability":[{"id":"315b1d8d-a5e3-3e64-a09a-9feb46e25a1d","vulnerability":{"id":"CVE-2026-65591","description":"n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator\u0027s computed-member handler. An authenticated user with workflow create or modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code execution as the n8n process. The legacy expression engine is the default in affected versions. Fixed in n8n 1.123.64, 2.29.8, and 2.30.1.","datePublished":"Jul 22, 2026, 11:21:40 AM","dateUpdated":"Oct 29, 2026, 9:16:22 PM","status":"PUBLISHED","baseScore":8.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L","references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-pm35-fqvh-cq5g\nhttps://www.vulncheck.com/advisories/n8n-before-sanitizer-bypass-remote-code-execution\n","enisa_id":"EUVD-2026-47635\n","assigner":"VulnCheck","epss":0.69,"dataProcessed":"Oct 30, 2026, 12:00:37 PM","vulnerabilityProduct":[{"id":"48153ef1-306b-3082-8d51-c3b918592a55","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"0 \u003c1.123.64"},{"id":"5fcf3843-53bb-337f-9b9c-cd931330a2eb","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"2.30.0 \u003c2.30.1"},{"id":"d1665a80-b177-3335-b2df-5a71f6142f4f","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"2.0.0-rc.0 \u003c2.29.8"}],"vulnerabilityVendor":[{"id":"8b457198-8bb1-3470-98a2-1b90271889cb","vendor":{"name":"n8n-io"}}]}},{"id":"477e71b3-cc60-32fb-89af-74d69070da7a","vulnerability":{"id":"GHSA-pm35-fqvh-cq5g","description":"n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution","datePublished":"Jul 22, 2026, 10:02:04 PM","dateUpdated":"Jul 22, 2026, 10:02:04 PM","baseScore":0.0,"references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-pm35-fqvh-cq5g\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-65591\nhttps://github.com/n8n-io/n8n\nhttps://github.com/n8n-io/n8n/releases/tag/n8n@1.123.64\nhttps://github.com/n8n-io/n8n/releases/tag/n8n@2.29.8\nhttps://github.com/n8n-io/n8n/releases/tag/n8n@2.30.1\nhttps://www.vulncheck.com/advisories/n8n-before-sanitizer-bypass-remote-code-execution\n","enisa_id":"EUVD-2026-47635\n","aliases":"CVE-2026-65591\nGHSA-pm35-fqvh-cq5g\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:58:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"f932ae2c-7d17-3015-9381-7311450ae51b","vulnerability":{"id":"GHSA-m7jc-p4hf-xhwq","description":"Duplicate Advisory: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution","datePublished":"Jul 22, 2026, 12:32:17 PM","dateUpdated":"Jul 22, 2026, 10:01:27 PM","baseScore":0.0,"references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-pm35-fqvh-cq5g\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-65591\nhttps://www.vulncheck.com/advisories/n8n-before-sanitizer-bypass-remote-code-execution\n","enisa_id":"EUVD-2026-47635\n","aliases":"GHSA-m7jc-p4hf-xhwq\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:58:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}