CVE-2026-77075 n8n-io CVE debrief

Who should care

Administrators and users of n8n versions before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 should be aware of this vulnerability and take steps to mitigate it. This includes restricting access to the n8n editor to trusted users, implementing input validation and sanitization for the resource-locator field, and monitoring for suspicious activity in n8n logs. Additionally, users should apply vendor patches or updates when available to prevent exploitation of this vulnerability. Security teams and vulnerability management teams should prioritize patching and review compensating controls for exposed systems while remediation is scheduled and verified. Operators of n8n should also review relevant monitoring, detection, and logs for exposed assets that need extra review. Asset inventory and change management processes should be updated to reflect the potential impact of this vulnerability on the organization. The vulnerability has a CVSS score of 8.4 and is classified as HIGH severity, indicating that it should be prioritized for remediation. The CVE record was published on 2026-08-20T12:16:38.870Z and has not been modified since then, providing a stable reference point for further investigation and mitigation efforts. The vulnerability affects multiple versions of n8n, including 1.x, 2.x, and 2.34.x, requiring a thorough review of the current deployment to identify potentially vulnerable instances. The expression injection vulnerability in the resource-locator field's link preview rendering allows for cross-user script execution, which can lead to unauthorized actions and data breaches if exploited. Therefore, it is essential to address this vulnerability promptly and thoroughly to protect against potential attacks. The n8n community and users should track exceptions, retest remediated assets, and close the item only after evidence is documented to ensure that the vulnerability has been fully mitigated. By taking these steps, organizations can reduce the risk associated with this vulnerability and protect their n8n deployments from potential exploitation. The vulnerability management process should include verifying the effectiveness of the patches and any

Technical summary

The n8n workflow automation tool contains an expression injection vulnerability in the resource-locator field's link preview rendering. An authenticated user can store a malicious value, which is then evaluated as JavaScript in the victim's authenticated session when another user opens the affected node, enabling cross-user script execution. This vulnerability affects n8n versions before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1. The vulnerability is caused by the editor splicing the field's stored value directly into the node type's URL template without checking for expression syntax.

Defensive priority

Authenticated users with list access can inject malicious expressions via the resource-locator field, enabling cross-user script execution when another user opens the affected node.

Recommended defensive actions

• Inventory n8n installations to identify potentially vulnerable versions.
• Restrict access to the n8n editor to trusted users.
• Implement input validation and sanitization for the resource-locator field.
• Monitor for suspicious activity in n8n logs.
• Apply vendor patches or updates when available.

Evidence notes

The CVE-2026-77075 record indicates that n8n versions before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 are vulnerable to an expression injection issue. An authenticated user can store a malicious value in the resource-locator field, which is then evaluated as JavaScript when another user opens the affected node in their authenticated session.

Official resources