Eval Injection Affecting n8n-nodes-base package, versions <1.121.15>=2.0.0 <2.9.1>=2.10.0 <2.10.1
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-N8NNODESBASE-15357606
- published26 Feb 2026
- disclosed25 Feb 2026
- crediteilonc-pillar
Introduced: 25 Feb 2026
NewCVE-2026-27493 (opens in a new tab)How to fix?
Upgrade n8n-nodes-base to version 1.121.15, 2.9.1, 2.10.1 or higher.
Overview
n8n-nodes-base is a Base nodes of n8n
Affected versions of this package are vulnerable to Eval Injection. An attacker can execute arbitrary code on the host system by submitting specially crafted form data that is interpreted as an expression.
Note:
This is only exploitable if a workflow contains a form node with a field that interpolates unauthenticated user input and the field value begins with an '=' character, causing double evaluation of the content.
Workaround
This vulnerability can be mitigated by manually reviewing form node usage for the described preconditions, or by disabling the Form node and Form Trigger node using the NODES_EXCLUDE environment variable.