n8n Just Had Its Worst Security Week — Critical 9.4 RCE Vulnerability. Here's What No-Code Automators Must Do Now

**TL;DR** — CVE-2026-25049 (CVSS 9.4) lets any authenticated n8n user execute arbitrary system commands by bypassing the expression sandbox. Proof-of-concept exploits are public. This is the second major expression-based RCE in six months. If you're running n8n below version 1.123.17 or 2.5.2, you are vulnerable. Patch now, audit your webhook exposure, and seriously reconsider whether an automation platform should be able to execute raw code at all.

---

n8n has had a bad week. A really bad week. The open-source workflow automation platform — widely used by no-code builders, ops teams, and developers who want self-hosted automation — disclosed CVE-2026-25049 on February 4, 2026. The vulnerability allows authenticated users to achieve full remote code execution through a type confusion attack in n8n's expression sanitizer. CVSS score: 9.4. Impact: total.

But here's why this is landing in July with fresh urgency: proof-of-concept exploits are now widely circulating, Censys scans show thousands of internet-facing n8n instances still running vulnerable versions, and — as if the universe wanted to prove a point — this is the second expression-based RCE in n8n in six months. CVE-2025-68613 was patched in version 1.120.4. CVE-2026-25049 is, in effect, a bypass of that fix.

The pattern is the part that should worry you.

## How the vulnerability actually works

The vulnerability sits in n8n's expression evaluation engine — the system that lets users write JavaScript expressions inside `{{}}` brackets within workflow parameters. These expressions are evaluated server-side, so n8n built a sanitizer to block access to dangerous JavaScript properties like `__proto__`, `constructor`, and `prototype`.

The sanitizer's `isSafeObjectProperty()` function takes a `property` parameter typed as `string` in TypeScript and checks it against a denylist using a `Set.has()` call. The problem: TypeScript's type annotations don't exist at runtime. An attacker can pass a non-string value — an array containing `["__proto__"]`, for example — and the `Set.has()` strict equality check won't match it, because an array is not a string. The sanitizer returns `true` ("this is safe") and the malicious expression sails through.

From there, an attacker chains property accesses to reach Node.js internals — `process.mainModule.require('child_process')` — and executes arbitrary system commands.

SecureLayer7, the researchers who discovered the vulnerability, found the bypass after more than 150 failed attempts and four hours of testing. Their write-up is worth reading if you want the full technical detail. The short version: n8n's previous fix (for CVE-2025-68613) added a `FunctionThisSanitizer` that bound `this` to an empty object, blocking access to `process.mainModule`. But the sanitizer only handled regular functions — arrow functions bypassed it entirely, and the new exploit chain uses destructuring syntax to defeat the remaining AST-level checks.

## The public webhook multiplier

Here's the thing that makes this worse than a standard authenticated RCE. n8n workflows can expose public webhooks with no authentication. An attacker who compromises a single account — through credential stuffing, a phishing campaign, or an insider — can create a workflow with a public webhook trigger, embed the malicious expression, and now anyone on the internet who sends an HTTP request to that webhook executes system commands on the n8n server.

The attack surface expands from "authenticated users" to "the entire internet, mediated by one compromised password."

Once an attacker has code execution, the blast radius is enormous. n8n instances typically hold:

- API keys and credentials for every integrated service (Slack, Gmail, databases, cloud providers)
- Database connection strings with read/write access to production data
- OAuth tokens for hundreds of third-party services
- Network-level access to internal systems that aren't otherwise internet-facing

A compromised n8n instance is not just a compromised automation server. It's a pivot point into every system the automation touches.

## What to do right now

**One: Patch.** If you're running n8n 1.x, update to 1.123.17 or later. If you're on 2.x, go to 2.5.2 or later. There were ten other vulnerabilities disclosed on the same day as CVE-2026-25049 — five of them critical — so this isn't a "patch one thing" situation. Update to current.

**Two: Audit your webhook exposure.** For every n8n instance you run, list all workflows that use Webhook nodes. For each one, ask: does this need to be public? If the answer isn't an immediate and confident yes, disable it or add authentication. If you're not sure, disable it. You can always turn it back on.

**Three: Rotate credentials.** Assume any credential stored in n8n's credential vault on a pre-patch instance is compromised. Rotate API keys, database passwords, and OAuth tokens. Yes, this is painful. It's less painful than explaining to your CFO that someone exfiltrated six months of financial data through your automation platform.

**Four: Audit workflow permissions.** Limit workflow creation and modification to the smallest possible set of trusted users. n8n's permission model is relatively coarse — if someone can create a workflow, they can potentially exploit this vulnerability. Treat workflow creation as a privileged action.

## The architectural question no-code teams should be asking

There's a broader conversation here that goes beyond patching this specific CVE. n8n's expression system is powerful because it lets users write arbitrary JavaScript. That power is the entire point — and also the entire problem. You cannot securely sandbox arbitrary JavaScript execution in a Node.js runtime with any confidence. The history of Node.js sandbox escapes is long and repetitive, and n8n's experience over the past six months (two critical expression-based RCEs, multiple patches, multiple bypasses) is the latest chapter in that story.

Platforms that don't expose raw code execution to end users structurally avoid this entire vulnerability class. If your automation builder doesn't let users write JavaScript expressions that are evaluated server-side, there's no expression sandbox to escape. If your platform's actions are pre-built, governed functions rather than arbitrary code execution, the attack surface collapses to whatever those functions explicitly permit.

Stacker and Bubble take this approach: users configure logic through visual interfaces and declarative rules, not through inline code blocks. That's not a limitation — it's a security boundary. You trade the ability to write `{{ (() => this.process.mainModule.require('child_process').exec('rm -rf /'))() }}` in a workflow parameter for the confidence that nobody can write that in a workflow parameter. For any team running business-critical automation, that trade is worth making.

## The takeaway

CVE-2026-25049 is serious, patchable, and already being exploited in the wild. Patch today, audit your webhooks, rotate your credentials. But the bigger question is whether your automation platform should be executing arbitrary code at all. The answer, for most teams building business-critical workflows, is no. Governed platforms that replace raw code execution with managed, sandboxed actions don't just reduce your attack surface — they eliminate an entire category of critical vulnerabilities that n8n has now demonstrated twice in six months is essentially unfixable at the architectural level.