CVE-2026-27493: 
NixOS vulnerability analysis and mitigation

CVE-2026-27493 is a second-order expression injection vulnerability in n8n's Form nodes, allowing unauthenticated attackers to inject and evaluate arbitrary n8n expressions by submitting crafted form data. Disclosed on February 25, 2026, it affects n8n versions prior to 1.123.22, versions 2.0.0 through 2.9.2, and version 2.10.0. When chained with an expression sandbox escape, the vulnerability can escalate to remote code execution (RCE) on the n8n host. It carries a CVSS v3.1 score of 9.0 (Critical) and a CVSS v4.0 score of 9.5 (Critical), though n8n assessed the practical severity as High due to real-world exploitation constraints (GitHub Advisory).

The root cause is improper control of code generation (CWE-94) and eval injection (CWE-95): when a Form node field value begins with an = character, n8n treats the entire value as an expression and performs a double-evaluation of the field content. This means that if a workflow interpolates unauthenticated user input into such a field — for example, =Thank you, {{ $input.first().json["Name"] }}! — a malicious user can inject arbitrary n8n expressions via the form submission. The attack vector is network-based and requires no authentication or user interaction, but does require the specific workflow misconfiguration (a field prefixed with = that reflects user input). Escalation to full RCE requires chaining with a separate sandbox escape vulnerability (GitHub Advisory, Pillar Security).

Successful exploitation of the expression injection alone grants access to all data within the n8n expression context, potentially exposing stored credentials, workflow configurations, and sensitive automation data. When chained with a sandbox escape, an attacker can achieve full remote code execution on the n8n host, enabling arbitrary command execution, lateral movement within the host environment, and exfiltration of all data accessible to the n8n process. The CVSS v4.0 score reflects high confidentiality, integrity, and availability impact on both the vulnerable component and downstream systems (GitHub Advisory, The Hacker News).

As of disclosure, there is no confirmed public proof-of-concept exploit, and no evidence of active in-the-wild exploitation has been reported (GitHub Advisory). However, Heise reported in March 2026 that attacks targeting this vulnerability were observed (Heise). The EPSS score is approximately 0.00188, indicating a low but non-negligible probability of exploitation. The vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires knowledge of a specific vulnerable workflow configuration or discovery by chance, limiting opportunistic mass exploitation. The vulnerability was reported by researcher eilonc-pillar (GitHub Advisory).

1. Reconnaissance: Identify publicly accessible n8n instances running vulnerable versions (< 1.123.22, 2.0.0–2.9.2, or 2.10.0) using tools like Shodan or Censys, or by browsing to known n8n form endpoints.
2. Identify vulnerable Form node: Locate a multi-step Form workflow where a downstream Form node renders user-provided input in a field that begins with = (e.g., =Thank you, {{ $input.first().json["Name"] }}!). This configuration causes n8n to treat the field as an expression.
3. Craft malicious form submission: Submit form data where the user-controlled field contains an n8n expression payload (e.g., injecting {{ <malicious_expression> }} as the name value), which will be double-evaluated by the Form node.
4. Achieve expression injection: The injected expression is evaluated within the n8n expression context, granting access to workflow data, environment variables, and stored credentials accessible in that context.
5. Chain with sandbox escape (for RCE): Combine the expression injection with a separate n8n expression sandbox escape technique to break out of the sandboxed evaluation environment and execute arbitrary shell commands on the n8n host (GitHub Advisory, Pillar Security).

• Network: Unusual or repeated POST requests to n8n Form node webhook endpoints from unexpected source IPs; outbound connections from the n8n host to unknown external IPs following form submissions.
• Logs: n8n application logs showing expression evaluation errors or unexpected expression results in Form node fields; log entries reflecting form submissions containing {{ or }} characters in user-supplied fields.
• Process: Unexpected child processes spawned by the n8n Node.js process (e.g., sh, bash, curl, wget) following form submissions, which may indicate successful sandbox escape and RCE.
• File System: New or modified files in the n8n working directory or temp directories created by the n8n process user; unexpected cron jobs or scheduled tasks added under the n8n service account.

Upgrade to patched versions: n8n 2.10.1, 2.9.3, or 1.123.22 (or later) immediately (GitHub Advisory, n8n Release 1.123.22, n8n Release 2.10.1). If immediate upgrade is not feasible, apply the following temporary mitigations: (1) Manually review all Form node configurations and remove any fields prefixed with = that interpolate user-supplied input; (2) Disable the Form node by adding n8n-nodes-base.form to the NODES_EXCLUDE environment variable; (3) Disable the Form Trigger node by adding n8n-nodes-base.formTrigger to the NODES_EXCLUDE environment variable. These workarounds do not fully remediate the risk and should only be used as short-term measures until a full upgrade is completed (GitHub Advisory).

n8n published a security blog post and community forum bulletin on February 25, 2026, the same day as disclosure, providing patch details and workarounds (n8n Blog, n8n Community). Pillar Security, whose researcher (eilonc-pillar) discovered and reported the vulnerability, published a detailed technical write-up describing the zero-click unauthenticated RCE chain (Pillar Security). The Hacker News and Infosecurity Magazine covered the vulnerability in March 2026, highlighting the RCE potential and credential exposure risk (The Hacker News, Infosecurity Magazine). Heise reported observed attacks targeting the vulnerability shortly after public disclosure (Heise). Community discussion on Reddit and LinkedIn reflected concern about the RCE potential in widely deployed automation workflows.