Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.9

n8n workflow tool may allow unauthorized code execution

CVE-2026-65591 · published 7 days ago
Summary

The n8n automation platform can be tricked into running code that an attacker supplies. This could let a malicious user take control of the system where n8n is installed. Apply the latest n8n updates that include the fix as soon as possible.

What to do
  • Update GitHub Actions n8n to version 1.123.64.
  • Update GitHub Actions n8n to version 2.30.1.
  • Update GitHub Actions n8n to version 2.29.8.
  • Update n8n to version 2.19.3-aikido.11.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.11.
  • Update n8n to version 2.19.3-aikido.12.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.12.
  • Update n8n to version 2.19.3-aikido.13.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.13.
  • Update n8n to version 2.19.3-aikido.14.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.14.
  • Update n8n to version 2.19.3-aikido.15.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.15.
Affected software
Ecosystem VendorProductAffected versions
– n8n-io n8n < 1.123.64
< 2.30.1
< 2.29.8
npm GitHub Actions n8n < 1.123.64
>= 2.30.0, < 2.30.1
>= 2.0.0-rc.0, < 2.29.8
Fix: upgrade to 1.123.64
– n8n n8n < 1.123.64
>= 2.0.0, < 2.29.8
2.30.0
cpe:2.3:a:n8n:n8n:*:*:*:*:community:node.js:*:*
Root:npm – n8n < 2.19.3-aikido.11
< 2.19.3-aikido.12
< 2.19.3-aikido.13
< 2.19.3-aikido.14
< 2.19.3-aikido.15
Fix: upgrade to 2.19.3-aikido.11
Root:npm rootio @rootio/n8n < 2.19.3-root.io.11
< 2.19.3-root.io.12
< 2.19.3-root.io.13
< 2.19.3-root.io.14
< 2.19.3-root.io.15
Fix: upgrade to 2.19.3-root.io.11
Original advisory text
CVE-2026-65591 in n8n - Patched by Root
Root has patched CVE-2026-65591 in the n8n package for Root:npm. Multiple fixed versions available.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.9 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-917Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
Timeline
Published6 Oct 2026
Updated11 Oct 2026
First seen22 Jul 2026
Sources
CVE-2026-65591 · NVD
CVE-2026-65591 · MITRE
GHSA-pm35-fqvh-cq5g · GHSA
GHSA-pm35-fqvh-cq5g · OSV
ROOT-APP-NPM-CVE-2026-65591 · OSV
Track software like this
Free during beta