CVE-2026-1470
1 advisory.
npm/n8n CVE-2026-1470: critical 9.9, EPSS 20.40%
n8n Unsafe Workflow Expression Evaluation Allows Remote Code Execution
Action: Upgrade n8n to 1.123.17 or later.
npm i n8n@1.123.17npm i n8n@2.4.5npm i n8n@2.5.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.123.17 | - |
| 2.0.0 | 2.4.5 | - |
| 2.5.0 | 2.5.1 | - |
Fixed versions
| 1.123.17 | 2.4.5 | 2.5.1 |
Sources
- osv: GHSA-5xrp-6693-jjx9
- https://nvd.nist.gov/vuln/detail/CVE-2026-1470
- https://github.com/n8n-io/n8n/commit/25c4b9605b420a98d0185a4f01115122a5134d8f
- https://github.com/n8n-io/n8n/commit/30383d86139f3279a698df8d229eadfefe8627f4
- https://github.com/n8n-io/n8n/commit/aa4d1e5825829182afa0ad5b81f602638f55fa04
- https://github.com/n8n-io/n8n
- https://research.jfrog.com/vulnerabilities/n8n-expression-node-rce
CVE-2026-1470 · published · modified · JSON