Cybersecurity researchers from JFrog have identified two high-severity vulnerabilities in the n8n workflow automation platform. These flaws, tracked as CVE-2026-1470 and CVE-2026-0863, involve eval injection weaknesses that allow authenticated users to bypass JavaScript and Python sandboxes. Successful exploitation could lead to full remote code execution (RCE) on the underlying system, potentially granting attackers access to sensitive organizational data and internal infrastructure.
The vulnerabilities highlight the inherent challenges of sandboxing dynamic languages like Python and JavaScript, where subtle language features can be leveraged to circumvent security controls. Users are strongly urged to update their n8n instances to the latest versions (specifically 1.123.17/2.4.5/2.5.1 and 1.123.14/2.3.5/2.4.2) to mitigate these risks, particularly if using the platform's "internal" execution mode in production.
Top comments (0)