N8
Product
n8n
On CISA KEVExploited in the wild
183
CVEs
1
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 30High 70Medium 83Low 0
Watch
Add n8n to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-68613 In wildKEV | 8.8 | Dec 19 | n8n Vulnerable to Remote Code Execution via Expression Injection Affected: 0.211.0 before 1.120.4; 1.121.0 |
| CVE-2026-86076 | 8.8 | Sep 8 | n8n: Expression Sandbox Escape in Editor-UI Enables Stored Cross-User JavaScript Execution Affected: before 1.123.76; 2.0.0 before 2.37.7; 2.38.0 before 2.38.2 |
| CVE-2026-86083 | 8.8 | Sep 8 | n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Execution Affected: before 1.123.76; 2.0.0 before 2.37.7; 2.38.0 before 2.38.2 |
| CVE-2026-85169 | 8.8 | Sep 3 | n8n before 1.123.73 Remote Code Execution via $fromAI Prototype Leak Affected: before 1.123.73; 2.0.0 before 2.35.4; 2.36.0 before 2.36.2 |
| CVE-2026-85168 | 8.8 | Sep 3 | n8n before 1.123.73 Remote Code Execution via Git Node Affected: before 1.123.73; 2.0.0 before 2.35.4; 2.36.0 before 2.36.2 |
| CVE-2026-77084 | 8.8 | Aug 20 | n8n before 1.123.69 Remote Code Execution via Git Node Configuration Values Affected: before 1.123.69; 2.0.0 before 2.33.4; 2.34.0 |
| CVE-2026-77080 | 8.8 | Aug 20 | n8n before 1.123.69 Arbitrary File Read and Write via Snowflake Affected: before 1.123.69; 2.0.0 before 2.33.4; 2.34.0 |
| CVE-2026-77079 | 8.8 | Aug 20 | n8n before 2.34.1 Authorization Bypass via Custom Role Deletion Affected: before 2.33.4; 2.34.0 |
| CVE-2026-77068 | 8.8 | Aug 20 | n8n before 2.34.1 Remote Code Execution via Path Traversal Affected: 2.33.0 before 2.33.4; 2.34.0 |
| CVE-2026-72775 | 8.8 | Aug 11 | n8n before 1.123.67 SQL Injection via PostgresTrigger Node Affected: before 1.123.67; 2.31.0 before 2.31.5; 2.32.0 |
| CVE-2026-72772 | 8.8 | Aug 11 | n8n before 2.32.1 Authentication Bypass via Token Exchange Affected: before 2.31.5; 2.32.0 |
| CVE-2026-72767 | 8.8 | Aug 11 | n8n before 1.123.67 Remote Code Execution via Git node Affected: before 1.123.67; 2.0.0 before 2.31.5; 2.32.0 |
| CVE-2026-72764 | 8.8 | Aug 11 | n8n before 1.123.67 Module Cache Poisoning via Code Node Affected: before 1.123.67; 2.0.0 before 2.31.5; 2.32.0 |
| CVE-2026-72762 | 8.8 | Aug 11 | n8n before 1.123.67 Arbitrary File Write via Edit Image Node Affected: before 1.123.67; 2.0.0 before 2.31.5; 2.32.0 |
| CVE-2026-72750 | 8.8 | Aug 11 | n8n before 1.123.67 SQL Injection via executeQuery Operation Affected: before 1.123.67; before 1.123.67; 2.0.0 before 2.31.5; 2.0.0 before 2.31.5; 2.32.0; 2.32.0 |
| CVE-2026-65595 | 8.8 | Jul 22 | n8n before 2.29.8 and 2.30.1 Privilege Escalation via Token Exchange Affected: before 2.29.8; before 2.29.8; 2.30.0; 2.30.0 |
| CVE-2026-65591 | 8.8 | Jul 22 | n8n before 1.123.64 Sanitizer Bypass Remote Code Execution Affected: before 1.123.64; before 1.123.64; 2.0.0 before 2.29.8; 2.0.0 before 2.29.8; 2.30.0; 2.30.0 |
| CVE-2026-65016 | 8.8 | Jul 22 | n8n before 1.123.64, 2.29.8, and 2.30.1 Privilege Escalation via SSO Instance-Role Affected: before 1.123.64; before 1.123.64; 2.0.0 before 2.29.8; 2.0.0 before 2.29.8; 2.30.0; 2.30.0 |
| CVE-2026-65015 | 8.8 | Jul 22 | n8n before 2.30.1 Privilege Escalation via run_node_tool Affected: before 2.29.8; before 2.29.8; 2.30.0; 2.30.0 |
| CVE-2026-59257 | 8.8 | Jul 8 | n8n - SQL Injection in MySQL v1 executeQuery Operation via Expression Interpolation Affected: before 1.123.61; before 2.28.1; before 2.27.4 |
| CVE-2025-71380 | 8.8 | Jul 4 | n8n - Arbitrary Command Execution via Execute Command Node Affected: through 1.114.4 |
| CVE-2026-44790 | 8.8 | Jun 23 | n8n: Arbitrary File Read via Git Node Affected: before 1.123.43; 2.0.0 before 2.20.7; 2.21.0 before 2.22.1 |
| CVE-2026-42237 | 8.8 | May 4 | n8n: SQL Injection in Snowflake and MySQL Nodes Affected: before 1.123.32; 2.17.0 before 2.17.4; 2.18.0 |
| CVE-2026-42234 | 8.8 | May 4 | n8n: Python Task Runner Sandbox Escape Affected: before 1.123.32; 2.17.0 before 2.17.4; 2.18.0 |
| CVE-2026-42232 | 8.8 | May 4 | n8n: XML Node Prototype Pollution to RCE Affected: before 1.123.32; 2.17.0 before 2.17.4; 2.18.0 |
| CVE-2026-42231 | 8.8 | May 4 | n8n: Prototype Pollution in XML Webhook Body Parser Leads to RCE Affected: before 1.123.32; 2.17.0 before 2.17.4; 2.18.0 |
| CVE-2026-42229 | 8.8 | May 4 | n8n: SQL Injection in SeaTable Node Affected: before 1.123.32; 2.17.0 before 2.17.4; 2.18.0 |
| CVE-2026-33713 | 8.8 | Mar 25 | n8n Vulnerable to SQL Injection in Data Table Node via orderByColumn Expression Affected: before 1.123.26; 2.0.0 before 2.13.3; 2.14.0 |
| CVE-2026-33696 | 8.8 | Mar 25 | n8n Vulnerable to Prototype Pollution in XML & GSuiteAdmin node parameters lead to RCE Affected: before 1.123.27; 2.0.0 before 2.13.3; 2.14.0 |
| CVE-2026-33660 | 8.8 | Mar 25 | n8n Has Multiple Remote Code Execution Vulnerabilities in Merge Node AlaSQL SQL Mode Affected: before 1.123.27; 2.0.0 before 2.13.3; 2.14.0 |
| CVE-2026-27498 | 8.8 | Feb 25 | n8n has Arbitrary Command Execution via File Write and Git Operations Affected: before 1.123.8; 2.0.0 before 2.2.0 |
| CVE-2026-27497 | 8.8 | Feb 25 | n8n has Potential Remote Code Execution via Merge Node Affected: before 1.123.22; 2.0.0 before 2.9.3; 2.10.0 before 2.10.1 |
| CVE-2026-25056 | 8.8 | Feb 4 | n8n Arbitrary File Write leading to RCE in n8n Merge Node Affected: before 1.118.0; 2.0.0 before 2.4.0 |
| CVE-2025-65964 | 8.8 | Dec 8 | n8n Vulnerable to Remote Code Execution via Git Node Custom Pre-Commit Hook Affected: 0.123.1 before 1.119.2 |
| CVE-2025-62726 | 8.8 | Oct 30 | n8n Vulnerable to Remote Code Execution via Git Node Pre-Commit Hook Affected: before 1.113.0 |
| CVE-2025-56265 | 8.8 | Sep 8 | An arbitrary file upload vulnerability in the Chat Trigger component of N8N v1.95.3, v1.100.1, and v1.101.1 allows attackers to execute arbitrary code via uploading a crafted HTML… Affected: 1.95.3; 1.100.1; 1.101.1 |
| CVE-2023-27563 | 8.8 | May 10 | The n8n package 0.218.0 for Node.js allows Escalation of Privileges Affected: 0.218.0 |
| CVE-2026-49444 | 8.5 | Jun 23 | n8n: Python sandbox escape Affected: before 1.123.48; 2.0.0 before 2.21.8; 2.22.0 before 2.22.4 |
| CVE-2026-54312 | 8.5 | Jun 23 | n8n: Microsoft SQL Node Prototype Pollution Affected: before 2.24.0 |
| CVE-2026-72768 | 8.3 | Aug 11 | n8n before 2.32.1 SSRF Protection Bypass via MCP Client Affected: 2.31.0 before 2.31.5; 2.32.0 |
| CVE-2026-72769 | 8.1 | Aug 11 | n8n before 1.123.67 Prototype Pollution via VM Expression Engine Affected: before 1.123.67; 2.0.0 before 2.31.5; 2.32.0 |
| CVE-2026-65596 | 8.1 | Jul 22 | n8n before 1.123.64 Credential Exfiltration via GraphQL Node Affected: before 1.123.64; before 1.123.64; 2.0.0 before 2.29.8; 2.0.0 before 2.29.8; 2.30.0; 2.30.0 |
| CVE-2026-45732 | 8.1 | Jun 23 | n8n: Cross-user Authorization Bypass in Dynamic Credential OAuth Endpoints Affected: before 1.123.43; 2.0.0 before 2.20.7; 2.21.0 before 2.22.1 |
| CVE-2026-25055 | 8.1 | Feb 4 | n8n Arbitrary File Write on Remote Systems via SSH Node Affected: before 1.123.12; 2.0.0 before 2.4.0f |
| CVE-2026-72773 | 7.7 | Aug 11 | n8n before 2.32.1 Path Traversal via computer-use search_files Affected: before 2.31.5; 2.32.0 |
| CVE-2026-56350 | 7.7 | Jun 30 | n8n - SSO Enforcement Bypass via API Affected: before 2.8.0 |
| CVE-2026-49465 | 7.7 | Jun 23 | n8n: Git Node Clone and Push Operations Bypass File Sandbox Affected: before 1.123.48; 2.0.0 before 2.21.8; 2.22.0 before 2.22.4 |
| CVE-2026-54304 | 7.7 | Jun 23 | n8n: SecurityScorecard Node Leaks API Token to User-Controlled Host Affected: before 1.123.55; 2.0.0 before 2.25.7; 2.26.0 before 2.26.1 |
| CVE-2026-54311 | 7.7 | Jun 23 | n8n: Merge Node SQL Mode Prototype Pollution Affected: before 2.25.7; 2.26.0 before 2.26.2 |
| CVE-2026-54313 | 7.7 | Jun 23 | n8n: NoSQL Injection in MongoDB Node Find And Replace Operation Affected: before 2.24.0 |