This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis β
Q1What is this vulnerability? (Essence + Consequences)
π¨ **Essence**: n8n workflow expression isolation is weak. π **Consequences**: Remote Code Execution (RCE). Attackers can hijack the system completely.
Q2Root Cause? (CWE/Flaw)
π‘οΈ **Root Cause**: CWE-95 (Improper Neutralization of Special Elements). The expression evaluation sandbox is bypassed. π **Flaw**: Inadequate isolation between user input and code execution.
Q3Who is affected? (Versions/Components)
π₯ **Affected**: All versions of **n8n** (the open-source workflow automation tool) prior to the fix. π¦ **Component**: The expression node/evaluation engine.
Q4What can hackers do? (Privileges/Data)
π **Capabilities**: Hackers gain **Full System Control**. π **Data**: They can read/write any data the n8n service can access. π **Privileges**: Equivalent to the n8n process user (often root/admin).
Q5Is exploitation threshold high? (Auth/Config)
β οΈ **Threshold**: **Low**. CVSS: AV:N (Network), AC:L (Low Complexity), UI:N (No User Interaction). π **Auth**: Requires **Low Privileges** (PR:L) to trigger. Not zero-click, but easy to exploit if you have access.
Q6Is there a public Exp? (PoC/Wild Exploitation)
π **Public Exp**: No specific PoC code in the CVE data. π’ **Advisory**: JFASC Research published a detailed advisory. π **Status**: High risk of wild exploitation due to low complexity.
Q7How to self-check? (Features/Scanning)
π **Self-Check**: Scan for n8n instances. π§ͺ **Test**: Try injecting malicious expressions in workflow nodes. π **Verify**: Check if the expression engine executes arbitrary JS/commands.
Q8Is it fixed officially? (Patch/Mitigation)
β **Fixed**: Yes. π οΈ **Patch**: Commit `aa4d1e5825829182afa0ad5b81f602638f55fa04` on GitHub. π **Action**: Update n8n to the patched version immediately.
Q9What if no patch? (Workaround)
π§ **Workaround**: If unpatched, **disable** the expression node or restrict workflow editing to trusted admins only. π« **Isolate**: Run n8n in a restricted container with minimal permissions.
Q10Is it urgent? (Priority Suggestion)
π₯ **Urgency**: **CRITICAL**. CVSS Score is High (H/H/H). π **Priority**: Patch immediately. RCE via low-priv access is a top-tier threat for automation tools.