n8n records
179 published records for vendor n8n.
Researcher profile
- Entered KEV
- 1 · 0.6%
- Weaponized
- 1 · 0.6%
- Pre-auth RCE
- 3
- With a fix record
- 100%
- Median publish → KEV
- 82 days
Recurring classes
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')19
- CWE-94 Improper Control of Generation of Code ('Code Injection')14
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')13
- CWE-639 Authorization Bypass Through User-Controlled Key13
- CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')12
- CWE-863 Incorrect Authorization12
The weakness classes this vendor ships most often: where to look.
CWEAll records
179 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
95Now | CVE-2025-68613Weaponized | n8n Vulnerable to Remote Code Execution via Expression Injectionn8n · n8n · CWE-913 | High8.8 | KEV | 98.9% | Dec 19, 2025 |
63This week | CVE-2026-21858Proof of concept | n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handlingn8n · n8n · CWE-20 | Critical10.0 | — | 78.1% | Jan 7, 2026 |
45Plan | CVE-2026-1470No exploit | Authenticated users can bypass the Expression sandbox mechanism to achieve full remote code execution on n8n’s main node.n8n · n8n · CWE-95 | Critical9.9 | — | 20.4% | Jan 27, 2026 |
43Plan | CVE-2025-68668No exploit | n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Noden8n · n8n · CWE-693 | Critical9.9 | — | 13.1% | Dec 26, 2025 |
42Plan | CVE-2026-0863No exploit | Sandbox escape in n8n Python task runner allows for arbitrary code execution on the underlying host.n8n · n8n · CWE-95 | Critical9.9 | — | 9.2% | Jan 18, 2026 |
41Plan | CVE-2026-21877Proof of concept | n8n is vulnerable to Remote Code Execution via Arbitrary File Writen8n · n8n · CWE-94 | Critical9.9 | — | 5.4% | Jan 7, 2026 |
40Plan | CVE-2026-27577Proof of concept | n8n: Expression Sandbox Escape Leads to RCEn8n · n8n · CWE-94 | Critical9.4 | — | 10.7% | Feb 25, 2026 |
38Monitor | CVE-2026-27493No exploit | n8n has Unauthenticated Expression Evaluation via Form Noden8n · n8n · CWE-94 | Critical9.5 | — | 1.3% | Feb 25, 2026 |
37Monitor | CVE-2026-25049Proof of concept | n8n Has an Expression Escape Vulnerability Leading to RCEn8n · n8n · CWE-913 | Critical9.4 | — | 1.5% | Feb 4, 2026 |
37Monitor | CVE-2026-21893No exploit | n8n Vulnerable to Command Injection in Community Package Installationn8n · n8n · CWE-20 | Critical9.4 | — | 1.5% | Feb 4, 2026 |
37Monitor | CVE-2026-33660No exploit | n8n Has Multiple Remote Code Execution Vulnerabilities in Merge Node AlaSQL SQL Moden8n · n8n · CWE-94 | Critical9.4 | — | 0.9% | Mar 25, 2026 |
37Monitor | CVE-2026-27497No exploit | n8n has Potential Remote Code Execution via Merge Noden8n · n8n · CWE-89 | Critical9.4 | — | 0.8% | Feb 25, 2026 |
37Monitor | CVE-2026-42231Proof of concept | n8n: Prototype Pollution in XML Webhook Body Parser Leads to RCEn8n · n8n · CWE-1321 | Critical9.4 | — | 0.8% | May 4, 2026 |
37Monitor | CVE-2026-33696No exploit | n8n Vulnerable to Prototype Pollution in XML & GSuiteAdmin node parameters lead to RCEn8n · n8n · CWE-1321 | Critical9.4 | — | 0.8% | Mar 25, 2026 |
37Monitor | CVE-2026-27495Proof of concept | n8n has a Sandbox Escape in its JavaScript Task Runnern8n · n8n · CWE-94 | Critical9.4 | — | 0.7% | Feb 25, 2026 |
37Monitor | CVE-2026-25056No exploit | n8n Arbitrary File Write leading to RCE in n8n Merge Noden8n · n8n · CWE-434 | Critical9.4 | — | 0.7% | Feb 4, 2026 |
37Monitor | CVE-2025-65964Proof of concept | n8n Vulnerable to Remote Code Execution via Git Node Custom Pre-Commit Hookn8n · n8n · CWE-829 | Critical9.4 | — | 0.7% | Dec 9, 2025 |
37Monitor | CVE-2026-25053Proof of concept | n8n is Vulnerable to OS Command Injection in Git Noden8n · n8n · CWE-78 | Critical9.4 | — | 0.6% | Feb 4, 2026 |
37Monitor | CVE-2026-25115No exploit | n8n is vulnerable to Python sandbox escapen8n · n8n · CWE-693 | Critical9.4 | — | 0.5% | Feb 4, 2026 |
37Monitor | CVE-2026-44791No exploit | n8n: XML Node Prototype Pollution Patch Bypassn8n · n8n · CWE-1321 | Critical9.4 | — | 0.5% | Jun 23, 2026 |
37Monitor | CVE-2026-44790No exploit | n8n: Arbitrary File Read via Git Noden8n · n8n · CWE-88 | Critical9.4 | — | 0.5% | Jun 23, 2026 |
37Monitor | CVE-2026-44789Proof of concept | n8n: HTTP Request Node Pagination Prototype Pollution to RCEn8n · n8n · CWE-1321 | Critical9.4 | — | 0.5% | Jun 23, 2026 |
37Monitor | CVE-2026-42232No exploit | n8n: XML Node Prototype Pollution to RCEn8n · n8n · CWE-1321 | Critical9.4 | — | 0.4% | May 4, 2026 |
37Monitor | CVE-2026-25052No exploit | n8n Improper File Access Controls Allow Arbitrary File Read by Authenticated Usersn8n · n8n · CWE-367 | Critical9.4 | — | 0.3% | Feb 4, 2026 |
36Monitor | CVE-2026-27498No exploit | n8n has Arbitrary Command Execution via File Write and Git Operationsn8n · n8n · CWE-94 | Critical9.0 | — | 0.8% | Feb 25, 2026 |
- CVE-2025-6861395Now
n8n Vulnerable to Remote Code Execution via Expression Injection
HighCVSS 8.8KEVWeaponizedEPSS 98%n8n · n8nDec 19, 2025
- CVE-2026-2185863This week
n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling
CriticalCVSS 10.0Proof of conceptEPSS 78%n8n · n8nJan 7, 2026
- CVE-2026-147045Plan
Authenticated users can bypass the Expression sandbox mechanism to achieve full remote code execution on n8n’s main node.
CriticalCVSS 9.9No exploitEPSS 20%n8n · n8nJan 27, 2026
- CVE-2025-6866843Plan
n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Node
CriticalCVSS 9.9No exploitEPSS 13%n8n · n8nDec 26, 2025
- CVE-2026-086342Plan
Sandbox escape in n8n Python task runner allows for arbitrary code execution on the underlying host.
CriticalCVSS 9.9No exploitEPSS 9%n8n · n8nJan 18, 2026
- CVE-2026-2187741Plan
n8n is vulnerable to Remote Code Execution via Arbitrary File Write
CriticalCVSS 9.9Proof of conceptEPSS 5%n8n · n8nJan 7, 2026
- CVE-2026-2757740Plan
n8n: Expression Sandbox Escape Leads to RCE
CriticalCVSS 9.4Proof of conceptEPSS 10%n8n · n8nFeb 25, 2026
- CVE-2026-2749338Monitor
n8n has Unauthenticated Expression Evaluation via Form Node
CriticalCVSS 9.5No exploitEPSS 1%n8n · n8nFeb 25, 2026
- CVE-2026-2504937Monitor
n8n Has an Expression Escape Vulnerability Leading to RCE
CriticalCVSS 9.4Proof of conceptEPSS 1%n8n · n8nFeb 4, 2026
- CVE-2026-2189337Monitor
n8n Vulnerable to Command Injection in Community Package Installation
CriticalCVSS 9.4No exploitEPSS 1%n8n · n8nFeb 4, 2026
- CVE-2026-3366037Monitor
n8n Has Multiple Remote Code Execution Vulnerabilities in Merge Node AlaSQL SQL Mode
CriticalCVSS 9.4No exploitEPSS 0%n8n · n8nMar 25, 2026
- CVE-2026-2749737Monitor
n8n has Potential Remote Code Execution via Merge Node
CriticalCVSS 9.4No exploitEPSS 0%n8n · n8nFeb 25, 2026
- CVE-2026-4223137Monitor
n8n: Prototype Pollution in XML Webhook Body Parser Leads to RCE
CriticalCVSS 9.4Proof of conceptEPSS 0%n8n · n8nMay 4, 2026
- CVE-2026-3369637Monitor
n8n Vulnerable to Prototype Pollution in XML & GSuiteAdmin node parameters lead to RCE
CriticalCVSS 9.4No exploitEPSS 0%n8n · n8nMar 25, 2026
- CVE-2026-2749537Monitor
n8n has a Sandbox Escape in its JavaScript Task Runner
CriticalCVSS 9.4Proof of conceptEPSS 0%n8n · n8nFeb 25, 2026
- CVE-2026-2505637Monitor
n8n Arbitrary File Write leading to RCE in n8n Merge Node
CriticalCVSS 9.4No exploitEPSS 0%n8n · n8nFeb 4, 2026
- CVE-2025-6596437Monitor
n8n Vulnerable to Remote Code Execution via Git Node Custom Pre-Commit Hook
CriticalCVSS 9.4Proof of conceptEPSS 0%n8n · n8nDec 9, 2025
- CVE-2026-2505337Monitor
n8n is Vulnerable to OS Command Injection in Git Node
CriticalCVSS 9.4Proof of conceptEPSS 0%n8n · n8nFeb 4, 2026
- CVE-2026-2511537Monitor
n8n is vulnerable to Python sandbox escape
CriticalCVSS 9.4No exploitEPSS 0%n8n · n8nFeb 4, 2026
- CVE-2026-4479137Monitor
n8n: XML Node Prototype Pollution Patch Bypass
CriticalCVSS 9.4No exploitEPSS 0%n8n · n8nJun 23, 2026
- CVE-2026-4479037Monitor
n8n: Arbitrary File Read via Git Node
CriticalCVSS 9.4No exploitEPSS 0%n8n · n8nJun 23, 2026
- CVE-2026-4478937Monitor
n8n: HTTP Request Node Pagination Prototype Pollution to RCE
CriticalCVSS 9.4Proof of conceptEPSS 0%n8n · n8nJun 23, 2026
- CVE-2026-4223237Monitor
n8n: XML Node Prototype Pollution to RCE
CriticalCVSS 9.4No exploitEPSS 0%n8n · n8nMay 4, 2026
- CVE-2026-2505237Monitor
n8n Improper File Access Controls Allow Arbitrary File Read by Authenticated Users
CriticalCVSS 9.4No exploitEPSS 0%n8n · n8nFeb 4, 2026
- CVE-2026-2749836Monitor
n8n has Arbitrary Command Execution via File Write and Git Operations
CriticalCVSS 9.0No exploitEPSS 0%n8n · n8nFeb 25, 2026