Vulnerability (CVE)
Pillar Security researchers disclosed two now-patched n8n flaws: CVE-2026-27577, a sandbox escape in the expression compiler where a missing case in the AST rewriter lets process slip through untransformed and gives any authenticated expression full remote...
CISA added CVE-2025-68613, a CVSS 9.9 expression injection flaw in n8n that allows remote code execution, to its Known Exploited Vulnerabilities catalog on Wednesday based on evidence of active exploitation. n8n patched the flaw in December 2025 in...
Google released Chrome security updates addressing two high-severity vulnerabilities it said were exploited in the wild: an out-of-bounds write in the Skia 2D graphics library (CVE-2026-3909) and an inappropriate implementation in the V8 JavaScript and...
n8n patched a high-severity expression-sandbox escape, tracked as GHSA-gv7g-jm28-cr3m with a CVSS 4.0 score of 8.7, that lets an authenticated workflow editor run operating-system commands as the n8n process. Security Joes found the flaw while probing...