CVE-2026-72765

Katalog CVE

CVSS 9.9 · Critical EPSS 0,86%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada n8n. Skor CVSS 3.1 9.9 (Critical) menurut NVD.

Deskripsi (NVD)

n8n before 2.31.5 and before 2.32.1 contain a sandbox escape vulnerability in expression evaluation. An authenticated user with permission to create or modify workflows can craft expressions using arrow-function bodies to bypass the expression sandbox, triggering system command execution on the host running n8n. The issue is fixed in versions 2.31.5 and 2.32.1.

Rincian

Terbit di NVD

11 Agustus 2026

Terakhir diubah

1 September 2026

Status NVD

Analyzed

CVSS 3.1

9.9 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

0,86% peluang dieksploitasi; lebih tinggi dari 57,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/n8n-io/n8n/security/advisories/GHSA-gv7g-jm28-cr3m mitigasi · advisory vendor
• https://www.vulncheck.com/advisories/n8n-before-remote-code-execution-via-expression-sandbox-escape advisory pihak ketiga