{"id":"CVE-2026-126391","aliases":["EUVD-2026-125174"],"status":"published","title":"n8n before 1.123.89 RCE via Workflow Expression Evaluation Sandbox Escape","description":"n8n before 1.123.89 contains an insufficient isolation vulnerability in workflow expression evaluation that allows authenticated users to escape the sandbox. Attackers with permission to create or modify workflows can craft expressions referencing unexpected JavaScript properties to execute arbitrary code on the n8n host.","severity":{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-94"],"published":"2026-11-13T09:35:54Z","modified":"2026-11-13T09:35:54Z","products":[{"vendor":"n8n-io","product":"n8n"}],"references":[{"url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-gx3v-3x3v-f8r5","tags":["vendor-advisory"]},{"url":"https://www.vulncheck.com/advisories/n8n-before-1.123.89-rce-via-workflow-expression-evaluation-sandbox-escape","tags":["third-party-advisory"]}],"sources":{"cve":[{"id":"CVE-2026-126391","title":"n8n before 1.123.89 RCE via Workflow Expression Evaluation Sandbox Escape","description":"n8n before 1.123.89 contains an insufficient isolation vulnerability in workflow expression evaluation that allows authenticated users to escape the sandbox. Attackers with permission to create or modify workflows can craft expressions referencing unexpected JavaScript properties to execute arbitrary code on the n8n host.","status":"published","published":"2026-11-13T09:35:54.388Z","modified":"2026-11-13T09:35:54.388Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-13T10:27:12.184616Z"}],"euvd":[{"id":"EUVD-2026-125174","description":"n8n before 1.123.89 contains an insufficient isolation vulnerability in workflow expression evaluation that allows authenticated users to escape the sandbox. Attackers with permission to create or modify workflows can craft expressions referencing unexpected JavaScript properties to execute arbitrary code on the n8n host.","status":"published","published":"2026-11-13T09:35:54Z","modified":"2026-11-13T09:35:54Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-13T10:38:07.336766Z"}]}}