n8n is an open source workflow automation platform. Prior to versions 1.123.17 and 2.5.2, an authenticated user with permission to create or modify workflows could abuse crafted expressions in workflow parameters to trigger unintended system command execution on the host running n8n. This issue has been patched in versions 1.123.17 and 2.5.2.

The version of the n8n Node.js Package installed on the remote host is prior to 1.123.17, or 2.x prior to 2.5.2. It is, therefore, affected by a remote code execution vulnerability:

  - An authenticated user with permission to create or modify workflows could abuse crafted expressions in workflow     parameters to trigger unintended system command execution on the host running n8n. (CVE-2026-25049)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - n8n is an open source workflow automation platform. Prior to versions 1.123.17 and 2.5.2, an authenticated
    user with permission to create or modify workflows could abuse crafted expressions in workflow parameters
    to trigger unintended system command execution on the host running n8n. This issue has been patched in
    versions 1.123.17 and 2.5.2. (CVE-2026-25049)

ID	Name	Product	Family	Severity
298984	n8n Node.js Package < 1.123.17 / 2.x < 2.5.2 Expression Escape Leading to RCE (CVE-2026-25049)	Nessus	Misc.	critical
437522	SCA: security update for n8n (GHSA-6cqr-8cfr-67f8)	Tenable Cloud Security	SCA Checks	critical
437522	SCA: security update for n8n (GHSA-6cqr-8cfr-67f8)	Tenable Self-Hosted Container Security	SCA Checks	critical

Detections

Analytics

CVE-2026-25049

critical

Tenable Plugins

critical

critical

critical