Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.4

n8n may execute unauthorized code via vm2

published 9 days ago
Summary

The n8n workflow automation tool includes the vm2 library version 3, which has a security weakness that could allow an attacker to run code on the server hosting n8n. This could lead to data exposure or system compromise. Apply the latest n8n update or replace the vm2 component with a patched version as soon as possible.

What to do
  • Update cleanstart n8n to version 2.28.0-r5.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart n8n < 2.28.0-r5
Fix: upgrade to 2.28.0-r5
Original advisory text
vm2 versions 3
Security vulnerability affects the n8n package. vm2 versions 3.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.4 Critical
Timeline
Published10 Oct 2026
Updated10 Oct 2026
First seen10 Oct 2026
Sources
CLEANSTART-2026-JW87371 · OSV
Track software like this
Free during beta