## https://sploitus.com/exploit?id=B3E39DC5-D089-5881-8643-611C001BE877
# CVE-2026-65591
Name of the Vulnerable Software and Affected Versions
n8n versions prior to 1.123.64
n8n versions prior to 2.29.8
n8n versions prior to 2.30.1
Description
A sanitizer bypass exists in the legacy expression evaluator's computed-member handler. An authenticated user with permissions to create or modify workflows can craft a malicious expression to bypass the sanitizer, leading to host-level code execution with the privileges of the n8n process. The legacy expression engine is the default in the affected versions.
Recommendations
Update to version 1.123.64 or later.
Update to version 2.29.8 or later.
Update to version 2.30.1 or later.
Switch to the non-legacy expression engine by setting N8N EXPRESSION ENGINE=vm.
Restrict instance access to fully trusted users only.