A critical Remote Code Execution (RCE) vulnerability has been disclosed in n8n, a widely used open-source workflow automation platform. The issue affects a large range of versions and could allow attackers to execute arbitrary code on vulnerable systems. ecurity researchers warn that unpatched instances may be fully compromised if exploited.
The flaw exists in n8n’s workflow expression evaluation mechanism. Under certain conditions, expressions supplied during workflow configuration are evaluated in an execution context that is not sufficiently isolated from the underlying runtime environment.
An authenticated attacker with permissions to create or edit workflows could abuse this behavior to inject malicious expressions. If successfully exploited, the attacker may execute arbitrary code with the same privileges as the n8n process itself.
This level of access could allow attackers to:
- Access or exfiltrate sensitive data
- Modify or sabotage workflows
- Execute system-level commands
- Gain persistent control over the affected server
The vulnerability impacts versions before 1.122.0.
Administrators are strongly advised to upgrade immediately to n8n v1.122.0 or later, which introduce additional safeguards to restrict unsafe expression evaluation.
If an upgrade is not immediately possible, the following temporary mitigations may reduce risk:
- Restrict workflow creation and editing permissions to fully trusted users only
- Deploy n8n in a hardened environment with limited operating system privileges and restricted network access
These mitigations should be short-term only and don’t fully eliminate the risk of exploitation.
Given the severity of this vulnerability and the potential for complete system compromise, organizations running n8n are urged to review their deployments and apply patches without delay.
Find further technical details and official remediation guidance on their official security advisory on GitHub here.
Leave a Reply