Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

n8n may run malicious code through outdated vm2

published 9 days ago
Summary

The n8n automation platform includes an older version of the vm2 component, which can allow someone to cause the system to execute unauthorized code. This could let an attacker manipulate workflows or access data. Upgrade n8n to the latest release, which includes a newer, safe version of vm2, or apply any patches provided by the vendor.

What to do
  • Update cleanstart n8n to version 2.28.0-r5.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart n8n < 2.28.0-r5
Fix: upgrade to 2.28.0-r5
Original advisory text
vm2 before 3
Security vulnerability affects the n8n package. vm2 before 3.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.9 Critical
Timeline
Published10 Oct 2026
Updated10 Oct 2026
First seen10 Oct 2026
Sources
CLEANSTART-2026-HO68117 · OSV
Track software like this
Free during beta