Dashboard / CVE-2026-65591

CVE-2026-65591

HIGH 1 PoC
MEDIUM Priority: 0.06 BB Relevance: 78/100
Published: 2026-07-22 Modified: 2026-10-29 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
AT: Present
VC: High
VI: High
VA: High

Description

n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code execution as the n8n process. The legacy expression engine is the default in affected versions. Fixed in n8n 1.123.64, 2.29.8, and 2.30.1.

Weakness Classification (1)

Affected Software (8)

VendorProductVersion
n8n n8n < 1.123.64
n8n n8n < 1.123.64
n8n n8n 2.30.0
n8n n8n 2.30.0
n8n-io n8n 0 < 1.123.64
n8n-io n8n 0 < 1.123.64
n8n-io n8n 2.30.0 < 2.30.1
n8n-io n8n 2.0.0-rc.0 < 2.29.8

References & Advisories (2)

Proof of Concept (1)

★ 1
https://github.com/IamDremig/CVE-2026-65591
nomi-sec

Bug Bounty Relevance

78 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction
✓ PoC available (1)

CVSS Score

8.9 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L

EPSS — Exploitation Probability

0.69%
Raw Score 0.006940
Percentile 52.9%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00694
2026-10-28
0.00694

Intelligence Sources

mitre ref →
nvd ref →

External Links