CVE-2026-1470: 
NixOS vulnerability analysis and mitigation

CVE-2026-1470 is a critical Remote Code Execution (RCE) vulnerability in n8n's workflow Expression evaluation system, classified as an Eval Injection (CWE-95). Discovered by Natan Nehorai of the JFrog Security Research Team and published on January 27, 2026, it affects n8n versions prior to 1.123.17, versions 2.0.0 through 2.4.5 (exclusive), and version 2.5.0. It carries a CVSS v3.1 base score of 9.9 (Critical) (JFrog Research, Red Hat CVE).

The vulnerability stems from insufficient isolation of n8n's Expression evaluation sandbox from the underlying Node.js runtime (CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code). Specifically, the sandbox failed to block JavaScript with statements and did not prevent shadowing of reserved internal variables such as ___n8n_data and __sanitize, which are used by the sandboxing mechanism itself. An attacker could craft an expression like {{ (function(){ var constructor = 123; with(function(){}){ return constructor("return process.mainModule.require('child_process').execSync('env').toString().trim()")() } })() }} to escape the sandbox and execute arbitrary OS commands. The patch (commit aa4d1e5) adds AST-level checks to block with statements and prevent redeclaration of reserved variable names in variable declarators, function parameters, and catch clauses (JFrog Research, GitHub Patch).

Successful exploitation grants an authenticated attacker arbitrary code execution with the privileges of the n8n process on the host system, resulting in high confidentiality, integrity, and availability impact with a changed scope. An attacker can read sensitive environment variables and credentials, modify or delete workflows, and perform arbitrary system-level operations — effectively achieving full compromise of the n8n instance and potentially the underlying host. The changed scope (S:C in CVSS) indicates that exploitation can affect resources beyond the n8n application itself, enabling lateral movement within the hosting environment (JFrog Research, Red Hat CVE).

Public proof-of-concept (PoC) exploit code is available both in the JFrog Security Research advisory and on GitHub (GitHub PoC, JFrog Research). The vulnerability requires only low privileges (any authenticated user account) and no user interaction, making it highly accessible to attackers. As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation, and it has not been added to the CISA KEV catalog. The EPSS score is approximately 0.347%, and the vulnerability was detected by Qualys (detection ID 733639) (Red Hat CVE).

1. Reconnaissance: Identify internet-facing n8n instances using tools like Shodan or Censys, targeting versions prior to 1.123.17 or 2.0.0–2.4.5 (or 2.5.0). Authenticate with any valid user account.
2. Navigate to workflow editor: Log into the n8n web interface and create a new workflow or open an existing one.
3. Select a vulnerable node: Add or open an "Edit Fields" (Set) node, which supports Expression evaluation in field name or value inputs.
4. Inject malicious expression: In the field name or value input, enter the following payload to escape the sandbox via a with statement:

   {{ (function(){ var constructor = 123; with(function(){}){ return constructor("return process.mainModule.require('child_process').execSync('id').toString().trim()")() } })()
   }}

5. Execute the step: Click "Execute step" or run the workflow. The expression evaluator processes the payload, bypassing sandbox restrictions via the with statement, which allows access to the real Function constructor through the scope chain.
6. Achieve RCE: The injected code executes as the n8n process user, returning command output (e.g., environment variables, user identity) in the workflow result, confirming full code execution on the host (JFrog Research, GitHub Patch).

• Logs: n8n application logs showing expression evaluation errors or unexpected output from workflow nodes containing with(, process.mainModule, child_process, or execSync strings; unusual workflow execution results containing OS command output (e.g., environment variable dumps, user IDs).
• Process: Unexpected child processes spawned by the n8n Node.js process (e.g., sh, bash, env, id, curl, wget) visible in process trees or audit logs.
• Network: Outbound connections from the n8n server to unknown external IPs or C2 infrastructure, particularly following workflow execution events.
• File System: New or modified files in the n8n working directory or system directories created by the n8n process user; unexpected cron jobs or scheduled tasks added under the n8n service account.
• Workflow Artifacts: Workflows containing expressions with with(, process.mainModule, require('child_process'), execSync, or attempts to shadow ___n8n_data or __sanitize variables (JFrog Research).

Upgrade n8n immediately to a patched version: 1.123.17 or later (for instances running versions below 2.0.0), or 2.4.5 or later (for instances running versions 2.0.0 and above); version 2.5.0 is also affected and should be upgraded to 2.5.1 or later. The fix is available in patch commit aa4d1e5 on GitHub. As interim mitigations, restrict workflow configuration and expression editing access to trusted users only, implement network segmentation to limit the blast radius of a potential compromise, and monitor n8n process execution for suspicious child process spawning or unusual system calls (JFrog Research, GitHub Patch).

The vulnerability received significant coverage from major security outlets including BleepingComputer, The Hacker News, Infosecurity Magazine, CSO Online, and Security Boulevard shortly after disclosure in late January 2026 (BleepingComputer, The Hacker News). JFrog Security Research, who discovered and reported the vulnerability, published a detailed technical advisory and PoC, and the issue was also analyzed by Orca Security and SOCRadar (JFrog Research, SOCRadar). Community discussion on Reddit, Mastodon, and Bluesky highlighted concern over the low privilege requirement and the availability of public PoC code, with some reports noting that tens of thousands of n8n instances could be exposed. VulnCheck published a blog post noting the vulnerability's relevance to the CISA KEV catalog discussion (VulnCheck).