A high-severity expression language injection vulnerability in n8n allows authenticated attackers to bypass security sanitizers and achieve remote code execution.

This vulnerability involves an improper neutralization of special elements in the legacy expression evaluator. An authenticated user can leverage this flaw to inject malicious expressions, leading to potential unauthorized code execution on the underlying host.

Successful exploitation of this vulnerability poses a severe risk to organizational infrastructure, as it allows for arbitrary code execution with the privileges of the n8n service. This can lead to complete system compromise, unauthorized data exfiltration, and lateral movement within the network. Given the CVSS score of 8.9, this vulnerability is considered a critical priority for remediation.

Immediate Action: Update n8n to version 1.123.64, 2.30.1, or 2.29.8 depending on your current deployment branch.

Proactive Monitoring: Review audit logs for suspicious expression evaluations or attempts to access system-level files through workflow nodes.

Compensating Controls: Implement strict network segmentation for the n8n instance and ensure the service runs with the least privilege necessary to limit the impact of a potential compromise.

Public Exploit Available: No

The severity of this flaw necessitates immediate attention. Administrators must verify their current n8n version and apply the provided patches without delay to prevent potential remote code execution.