CVE-2026-27493 is a critical (CVSS 9.0) second order expression injection in n8n Form nodes. An unauthenticated attacker can get submitted form data evaluated as an n8n expression. Upgrade to 2.10.1, 2.9.3 or 1.123.22, and review form workflows for the precondition the advisory describes.
What's affected
n8n versions before 2.10.1, 2.9.3 and 1.123.22. The fixed releases are 2.10.1, 2.9.3 and 1.123.22, one for each release line.
Exploitation needs a specific workflow setup. A form node field must interpolate a value from an unauthenticated user, and the value must begin with an equals sign so n8n treats it as an expression and evaluates it twice.
How to check if you're exposed
Check your n8n version, for example:
n8n --version
Then review workflows that use Form nodes. Look for fields that interpolate submitted values, and for any field that starts with an equals sign. The advisory says there is no practical reason to add that prefix on purpose, so a field like that would be an accident or a sign of tampering.
What to do now
- Upgrade n8n to 2.10.1, 2.9.3 or 1.123.22 or later.
- Review Form node usage for the preconditions in the advisory.
- If you cannot upgrade, the advisory lists disabling the Form node as a temporary mitigation, and you should read its full text.
- Restrict who can create and edit workflows.
- Treat the workaround as short term, since it does not fix the cause.
Why it matters
The record lists CWE-94 and CWE-95, code injection and eval injection. In second order injection, data is stored or passed along first and evaluated later. Here a field was evaluated twice, so submitted content got treated as an expression.
The advisory is careful about limits. On its own, the injection reaches only data in the expression context, and code execution on the host needs a separate sandbox escape. Related n8n advisories in the same release, such as CVE-2026-27494 and CVE-2026-27495, describe such escapes by authenticated users. The record does not mark this CVE as known exploited.
Quick check
Does this lead to code execution on its own?
No. The advisory says escalation to remote code execution needs a chained sandbox escape.
Sources
- CVE-2026-27493 on Gold
- GitHub advisory listed in the record: https://github.com/n8n-io/n8n/security/advisories/GHSA-75g8-rv7v-32f7
- Release listed in the record: https://github.com/n8n-io/n8n/releases/tag/n8n@2.10.1
Last reviewed: 19 October 2026.
