CyberRota Analysis
AI-GeneratedThe legacy expression engine in n8n versions prior to 1.123.76, 2.37.7, and 2.38.2 is vulnerable to code injection due to the use of a mutable global JSON.stringify, allowing attackers to execute arbitrary code through crafted expressions. Organizations utilizing n8n for workflow automation should prioritize upgrading to the patched versions to mitigate the risk of exploitation and potential compromise of their systems.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the legacy expression engine generated source text by calling the mutable global JSON.stringify while printing synthetic string literals and interpolating timezone data. An expression could replace JSON.stringify and cause later generated source to contain executable attacker-controlled code. The affected code-generation paths include packages/@n8n/expression-runtime/src/bridge/isolated-vm-bridge.ts and packages/@n8n/tournament/src/ExpressionBuilder.ts, and the issue does not affect the vm expression engine. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.
Related CVEs
Other vulnerabilities affecting the same vendor(s)