Expression Injection Vulnerability in n8n Workflow Automation Software

CVE-2026-77075

What is CVE-2026-77075?

Versions of n8n prior to 1.123.69 and 2.x before 2.33.4, as well as 2.34.x before 2.34.1, have been found to contain an expression injection flaw. This vulnerability arises in the resource-locator field, where the stored value is directly incorporated into a node type's URL template without adequate validation of expression syntax. By exploiting this issue, an authenticated user can insert a malicious value. Consequently, when another user accesses the affected node in the editor, the injected expression is executed as JavaScript within the victim's session, potentially leading to unauthorized actions in a trusted context.

References