Improper Control of Dynamically-Managed Code Resources in n8n - CVE-2026-25049
Published: February 9, 2026
Vulnerability identifier: #VU122481
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-25049
CWE-ID: CWE-913
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to compromise the affected system.
The vulnerability exists due to an incomplete fix in the expression evaluation for #VU120269 (CVE-2025-68613). A remote user with permission to create or modify workflows could abuse crafted expressions in workflow parameters to trigger unintended system command execution on the host running n8n.
Affected software
n8n
How to mitigate CVE-2026-25049
Install updates from vendor's website.
n8n - addressed in versions 1.123.17, 2.5.2