Two critical vulnerabilities in the n8n workflow automation platform—CVE-2026-1470 and CVE-2026-0863—can be abused to bypass AST-based sandboxes and achieve remote arbitrary code execution in JavaScript and Python evaluation flows. JFrog reports these flaws allow full n8n instance takeover and were fixed in n8n releases 1.123.17/1.123.14, 2.4.5/2.3.5, and 2.5.1/2.4.2. #n8n #JFrog
Keypoints
- CVE-2026-1470 (CVSS 9.9) affects the JavaScript expression evaluation engine and enables arbitrary JS execution.
- CVE-2026-0863 (CVSS 8.5) impacts the Python Code node execution flow and can lead to RCE when running in the “Internal” configuration.
- Both issues exploit weaknesses in AST sanitization, including support for a deprecated statement and other subtle language features.
- JFrog demonstrated these sandbox bypasses can fully compromise an n8n instance by escaping the AST-based controls.
- Patches were released for affected versions; operators should upgrade to the fixed n8n releases immediately.
Read More: https://www.securityweek.com/n8n-vulnerabilities-could-lead-to-remote-code-execution/