| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| n8n | ≥ 2.0.0, < 2.9.3≥ 2.10.0, < 2.10.1< 1.123.22 | 2.9.32.10.11.123.22 |
| n8n | ≥ 2.0.0, < 2.9.3≥ 2.10.0, < 2.10.1< 1.123.22 | 2.9.32.10.11.123.22 |
A second-order expression injection vulnerability existed in n8n's Form nodes that could allow an unauthenticated attacker to inject and evaluate arbitrary n8n expressions by submitting crafted form data. When chained with an expression sandbox escape, this could escalate to remote code execution on the n8n host.
The vulnerability requires a specific workflow configuration to be exploitable:
= character, which caused n8n to treat it as an expression and triggered a double-evaluation of the field content.
For example, a workflow uses a multi-step Form where a downstream Form node renders user-provided input back in an HTML field and precedes it with an = sign:
=<h2>Thank you, {{ $input.first().json[\"Name\"] }}!</h2>There is no practical reason for a workflow designer to prefix a field with = intentionally — the character is not rendered in the output, so the result would not match the designer's expectations. If added accidentally, it would be noticeable and very unlikely to persist. An unauthenticated attacker would need to either know about this specific circumstance on a target instance or discover a matching form by chance.
Even when the preconditions are met, the expression injection alone is limited to data accessible within the n8n expression context. Escalation to remote code execution requires chaining with a separate sandbox escape vulnerability.
Due to these real-world constraints — the unlikely workflow configuration, the need for an additional sandbox escape, and the difficulty of discovery — we have assessed the severity as High rather than Critical, diverging from the base CVSS score to better reflect actual exploitability.
The issue has been fixed in n8n versions 2.10.1, 2.9.3, and 1.123.22. Users should upgrade to one of these versions or later to remediate the vulnerability.
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
n8n-nodes-base.form to the NODES_EXCLUDE environment variable.n8n-nodes-base.formTrigger to the NODES_EXCLUDE environment variable.These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí