●PocketClawAI security alerts
Sign in
highCVSS 8.8NVD status: Analyzed

CVE-2026-65591

n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler.

Componentn8n
Severityhigh (CVSS 8.8)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published (NVD)2026-07-22
Last modified2026-07-27
Affected versions
n8n < 1.123.64
n8n < 1.123.64
n8n >= 2.0.0, < 2.29.8
n8n >= 2.0.0, < 2.29.8
n8n = 2.30.0
n8n = 2.30.0
Fixed in1.123.64, 2.29.8
WeaknessCWE-917
CISA KEVnot listed

NVD description

n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code execution as the n8n process. The legacy expression engine is the default in affected versions. Fixed in n8n 1.123.64, 2.29.8, and 2.30.1.

Does CVE-2026-65591 hit the version you run?Paste your docker-compose.yml, requirements.txt or package.json. The scanner checks your pinned versions against this CVE and every other one we track for n8n.
Check my stack

What to do

  • Upgrade n8n to 1.123.64 or later (or the patched release of your branch: 2.29.8).
  • Do not expose the component's API or UI to the internet without authentication in front of it.

Sources

Read more

Other n8n CVEs

high
CVE-2026-103247CVSS 8.5

n8n versions before 1.123.80 contain a credential tampering vulnerability where duplicate node IDs bypass the workflow credential tamper gua...

n8n
2026-10-01high
CVE-2026-103249CVSS 7.6

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a stored DOM cross-site scripting vulnerabilit...

n8n
2026-10-01critical
CVE-2026-103255CVSS 9

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase...

n8n
2026-10-01high
CVE-2026-103246CVSS 7.7

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool introspection. Attac...

n8n
2026-10-01critical
CVE-2026-103248CVSS 9

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supaba...

n8n
2026-10-01high
CVE-2026-103250CVSS 8.1

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a NoSQL injection vulnerability in the MongoDB...

n8n
2026-10-01

All n8n CVEs