CVE-2026-27493

{"id": "CVE-2026-27493", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.2}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2026-02-25T23:16:20.440", "references": [{"url": "https://github.com/n8n-io/n8n/commit/562d867483e871b0f1e31776252e23bd721df75b", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/n8n-io/n8n/issues/19", "tags": ["Issue Tracking"], "source": "security-advisories@github.com"}, {"url": "https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.22", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/n8n-io/n8n/releases/tag/n8n@2.10.1", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/n8n-io/n8n/releases/tag/n8n@2.9.3", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-75g8-rv7v-32f7", "tags": ["Vendor Advisory", "Mitigation"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-95"}]}], "descriptions": [{"lang": "en", "value": "n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, a second-order expression injection vulnerability existed in n8n's Form nodes that could allow an unauthenticated attacker to inject and evaluate arbitrary n8n expressions by submitting crafted form data. When chained with an expression sandbox escape, this could escalate to remote code execution on the n8n host. The vulnerability requires a specific workflow configuration to be exploitable. First, a form node with a field interpolating a value provided by an unauthenticated user, e.g. a form submitted value. Second, the field value must begin with an `=` character, which caused n8n to treat it as an expression and triggered a double-evaluation of the field content. There is no practical reason for a workflow designer to prefix a field with `=` intentionally \u2014 the character is not rendered in the output, so the result would not match the designer's expectations. If added accidentally, it would be noticeable and very unlikely to persist. An unauthenticated attacker would need to either know about this specific circumstance on a target instance or discover a matching form by chance. Even when the preconditions are met, the expression injection alone is limited to data accessible within the n8n expression context. Escalation to remote code execution requires chaining with a separate sandbox escape vulnerability. The issue has been fixed in n8n versions 2.10.1, 2.9.3, and 1.123.22. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations. Review usage of form nodes manually for above mentioned preconditions, disable the Form node by adding `n8n-nodes-base.form` to the `NODES_EXCLUDE` environment variable, and/or disable the Form Trigger node by adding `n8n-nodes-base.formTrigger` to the `NODES_EXCLUDE` environment variable. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures."}, {"lang": "es", "value": "n8n es una plataforma de automatizaci\u00f3n de flujos de trabajo de c\u00f3digo abierto. Antes de las versiones 2.10.1, 2.9.3 y 1.123.22, exist\u00eda una vulnerabilidad de inyecci\u00f3n de expresiones de segundo orden en los nodos de formulario de n8n que podr\u00eda permitir a un atacante no autenticado inyectar y evaluar expresiones n8n arbitrarias al enviar datos de formulario manipulados. Cuando se encadena con un escape de sandbox de expresiones, esto podr\u00eda escalar a ejecuci\u00f3n remota de c\u00f3digo en el host n8n. La vulnerabilidad requiere una configuraci\u00f3n de flujo de trabajo espec\u00edfica para ser explotable. Primero, un nodo de formulario con un campo que interpola un valor proporcionado por un usuario no autenticado, p. ej., un valor enviado en un formulario. Segundo, el valor del campo debe comenzar con un car\u00e1cter '=', lo que hizo que n8n lo tratara como una expresi\u00f3n y desencadenara una doble evaluaci\u00f3n del contenido del campo. No hay una raz\u00f3n pr\u00e1ctica para que un dise\u00f1ador de flujo de trabajo prefije un campo con '=' intencionalmente \u2014 el car\u00e1cter no se renderiza en la salida, por lo que el resultado no coincidir\u00eda con las expectativas del dise\u00f1ador. Si se a\u00f1ade accidentalmente, ser\u00eda notorio y muy poco probable que persistiera. Un atacante no autenticado necesitar\u00eda conocer esta circunstancia espec\u00edfica en una instancia objetivo o descubrir un formulario coincidente por casualidad. Incluso cuando se cumplen las precondiciones, la inyecci\u00f3n de expresiones por s\u00ed sola se limita a los datos accesibles dentro del contexto de expresiones de n8n. La escalada a ejecuci\u00f3n remota de c\u00f3digo requiere encadenarse con una vulnerabilidad de escape de sandbox separada. El problema ha sido solucionado en las versiones de n8n 2.10.1, 2.9.3 y 1.123.22. Los usuarios deben actualizar a una de estas versiones o posteriores para remediar la vulnerabilidad. Si la actualizaci\u00f3n no es posible de inmediato, los administradores deben considerar las siguientes mitigaciones temporales. Revisar manualmente el uso de los nodos de formulario para las precondiciones mencionadas anteriormente, deshabilitar el nodo Formulario a\u00f1adiendo 'n8n-nodes-base.form' a la variable de entorno 'NODES_EXCLUDE', y/o deshabilitar el nodo Form Trigger a\u00f1adiendo 'n8n-nodes-base.formTrigger' a la variable de entorno 'NODES_EXCLUDE'. Estas soluciones alternativas no remedian completamente el riesgo y solo deben usarse como medidas de mitigaci\u00f3n a corto plazo."}], "lastModified": "2026-03-05T16:29:28.867", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "77E36F68-2FDD-4771-B2DD-3F0A168E92E1", "versionEndExcluding": "1.123.22"}, {"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "CDB18D4D-1D4C-422A-BE3E-0FF8FC9DDD82", "versionEndExcluding": "2.9.3", "versionStartIncluding": "2.0.0"}, {"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "C2CBC039-F880-4DB3-968B-2520126388E6", "versionEndExcluding": "2.10.1", "versionStartIncluding": "2.10.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}