GHSA-v98v-ff95-f3cp
Critical · 9.9CVSS
9.9
EPSS
—
Published
Dec 22, 2025
CISA due date
—
The record
n8n Vulnerable to Remote Code Execution via Expression Injection
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | n8n | 0.211.0 | 1.120.4 |
| npm | n8n | 1.121.0 | 1.121.1 |
Related vulnerabilities
- CVE-2025-68613 n8n is an open source workflow automation platform. Same vulnerability
- CVE-2026-27577 n8n is an open source workflow automation platform. Same vulnerability
- CVE-2026-54308 n8n is an open source workflow automation platform. Also affects n8n
- CVE-2026-54307 n8n is an open source workflow automation platform. Also affects n8n
- CVE-2026-54304 n8n is an open source workflow automation platform. Also affects n8n
- CVE-2026-54305 n8n is an open source workflow automation platform. Also affects n8n
- CVE-2026-54306 n8n is an open source workflow automation platform. Also affects n8n
- CVE-2026-54302 n8n is an open source workflow automation platform. Also affects n8n