CVE-2026-27493
📋 TL;DR
This CVE describes a second-order expression injection vulnerability in n8n's Form nodes that could allow unauthenticated attackers to inject and evaluate arbitrary n8n expressions. When combined with a sandbox escape vulnerability, this could lead to remote code execution on the n8n host. The vulnerability affects n8n users with specific workflow configurations where form fields interpolate user-provided values starting with '='.
💻 Affected Systems
- n8n
📦 What is this software?
N8n by N8n
N8n by N8n
N8n by N8n
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution on the n8n host when chained with a sandbox escape vulnerability, potentially leading to complete system compromise.
Likely Case
Expression injection limited to data accessible within n8n's expression context, potentially exposing sensitive workflow data or configuration.
If Mitigated
No impact if proper patching or workarounds are implemented and vulnerable workflows are not present.
🎯 Exploit Status
Exploitation requires specific workflow configuration and chaining with separate sandbox escape vulnerability for RCE. Discovery of vulnerable forms would be difficult without prior knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.10.1, 2.9.3, or 1.123.22
Vendor Advisory: https://github.com/n8n-io/n8n/releases
Restart Required: Yes
Instructions:
1. Stop n8n service. 2. Update n8n to version 2.10.1, 2.9.3, or 1.123.22 using your package manager or installation method. 3. Restart n8n service.
🔧 Temporary Workarounds
Disable Form Nodes
allAdd form nodes to NODES_EXCLUDE environment variable to disable them
export NODES_EXCLUDE="n8n-nodes-base.form,n8n-nodes-base.formTrigger"
🧯 If You Can't Patch
- Manually review all workflows for form nodes that interpolate user input and ensure no fields accept values starting with '='
- Implement network segmentation to restrict access to n8n instances from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Check n8n version and review workflows for form nodes with user-input interpolation fieldsCheck Version:
n8n --versionVerify Fix Applied:
Verify n8n version is 2.10.1, 2.9.3, or 1.123.22 or later📡 Detection & Monitoring
Log Indicators:
- Unusual expression evaluation errors in n8n logs
- Form submissions containing '=' prefix in field values
Network Indicators:
- HTTP POST requests to form endpoints with crafted payloads
SIEM Query:
source="n8n" AND ("expression error" OR "form submission" AND "=")🔗 References
- https://github.com/n8n-io/n8n/commit/562d867483e871b0f1e31776252e23bd721df75b
- https://github.com/n8n-io/n8n/issues/19
- https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.22
- https://github.com/n8n-io/n8n/releases/tag/n8n@2.10.1
- https://github.com/n8n-io/n8n/releases/tag/n8n@2.9.3
- https://github.com/n8n-io/n8n/security/advisories/GHSA-75g8-rv7v-32f7
