A critical remote code execution vulnerability in n8n is currently being actively exploited in the wild, posing a severe risk of full system compromise.

The vulnerability is an improper control of dynamically managed code resources (CWE-913) located within the workflow expression evaluation system. Authenticated users can supply expressions during workflow configuration that execute in an insufficiently isolated runtime environment, leading to remote code execution.

The CVSS score of 9.5 indicates a critical severity level, reflecting the potential for complete loss of confidentiality, integrity, and availability. Successful exploitation grants an attacker the ability to execute arbitrary system-level commands, which may result in the theft of sensitive workflow data, unauthorized access to connected services, and total compromise of the underlying host environment.

Immediate Action: Upgrade n8n to version 1.120.4, 1.121.1, or 1.122.0 immediately to apply the necessary security safeguards to the expression evaluation engine.

Proactive Monitoring: Review application and system logs for unusual workflow executions, unauthorized process spawning, or suspicious outbound network traffic originating from the n8n container or server.

Compensating Controls: If an immediate upgrade is not feasible, restrict workflow creation and editing permissions to only the most trusted users and ensure the instance is isolated within a hardened, low-privilege environment.

Public Exploit Available: Yes, a Metasploit module exists and multiple public proof of concept repositories are available on GitHub.

Given the confirmed active exploitation and the critical nature of the remote code execution flaw, organizations must prioritize patching their n8n instances. Immediate application of the fixed versions is the only reliable method to mitigate this threat, as environmental mitigations provide only a temporary reduction in attack surface.