Summary
Duplicate Advisory: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution
Advisory details
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-pm35-fqvh-cq5g. This link is maintained to preserve external references.
Original Description
n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code execution as the n8n process. The legacy expression engine is the default in affected versions. Fixed in n8n 1.123.64, 2.29.8, and 2.30.1.
References
Related vulnerabilities
All Supply chain →- HIGHCVE-2026-65591
n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution
- HIGHGHSA-7q9c-hpx7-9cwm
TypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stop
- CRITICALCVE-2026-73842
OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation
- MEDIUMCVE-2026-73557
vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts
- MEDIUMCVE-2026-73556
vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2m
- MEDIUMCVE-2026-73555
vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages