CVE-2026-27577

CVE-2026-27577 is a critical code injection vulnerability affecting n8n, an open-source workflow automation platform, in versions prior to 2.10.1, 2.9.3, and 1.123.22. An authenticated user with workflow creation or modification permissions can execute arbitrary system commands on the host by crafting malicious expressions. This vulnerability carries a CVSS score of 9.9 (CRITICAL) due to its network-based attack vector, low complexity, and high impact on confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion, indicating awareness and potential for future exploitation.