CVE-2026-77075
Received Received - Intake

Expression Injection in n8n Workflow Automation Tool

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: VulnCheck

Description
n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an expression injection vulnerability in resource-locator field link preview rendering. The editor spliced the field's stored value directly into the node type's URL template without checking for expression syntax. An authenticated member can store a malicious value so that when another user opens the affected node in the editor, the injected expression is evaluated as JavaScript in the victim's authenticated session (cross-user script execution).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-77075
EUVD
EUVD-2026-63264

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
n8n n8n to 2.34.1 (exc)
n8n n8n to 2.33.4 (exc)
n8n n8n to 1.123.69 (exc)
n8n n8n From 2.33.4 (exc)
n8n n8n From 2.34.0 (inc) to 2.34.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-77075 is an expression injection vulnerability in n8n, an open-source workflow automation tool. It affects versions before 1.123.69, 2.33.4, and 2.34.1. The flaw occurs in the resource-locator field's link preview rendering, where malicious JavaScript expressions stored in a field's value are executed when another user views the node in the editor. This happens because the system directly embeds the stored value into a URL template without checking for expression syntax.

Detection Guidance

Check if your n8n instance is running a vulnerable version by running: n8n --version. If the version is below 1.123.69, 2.33.4, or 2.34.1, the system is affected. Inspect workflows for suspicious resource-locator fields that may contain JavaScript expressions.

Impact Analysis

An attacker could exploit this to run malicious JavaScript in your authenticated session, potentially stealing sensitive data, modifying workflows, or performing unauthorized actions. Since the attack occurs when viewing a node, even trusted users could unknowingly trigger the exploit.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Organizations using affected n8n versions may face compliance risks if exploited.

Mitigation Strategies

Upgrade n8n to version 1.123.69 or later, 2.33.4 or later, or 2.34.1 or later immediately. As a temporary measure, restrict instance access to trusted users, disable workflow imports, or limit sharing permissions until the upgrade is complete.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77075. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart