n8n has shipped a fix for CVE-2026-25049, a critical vulnerability in the expression sandbox that lets users build dynamic logic into their automation workflows. An authenticated user with permission to create or edit a workflow, which in many organisations means a sizeable chunk of the team, can craft an expression that escapes the sandbox entirely and executes arbitrary system commands on the host running n8n. CVSS scoring puts it as high as 9.9 under version 3.1 and 9.4 under version 4.0. Fixed versions are 1.123.17 and 2.5.2. n8n Cloud customers were already protected server-side; anyone self-hosting needed to patch themselves.
This is not the first time this sandbox has broken
What makes CVE-2026-25049 worth more attention than a routine critical patch is what it actually is: a bypass of the fix that shipped for CVE-2025-68613, a nearly identical expression-sandbox escape patched only in December. The same category of flaw, in the same component, defeated the same remediation inside eight months. That is not an indictment of n8n specifically so much as a reminder of a pattern that recurs across every platform that lets users write logic which gets evaluated server-side: sandbox escapes tend to come in families, and the first patch for one rarely closes the whole door. Anyone treating the December fix as the end of the story now has evidence that assumption was premature.
Self-hosting for sovereignty means the patching burden is entirely yours
n8n’s popularity across Europe owes a lot to organisations choosing to self-host it deliberately, specifically to keep workflow data, credentials, and business logic off US-owned SaaS infrastructure and inside their own environment for GDPR and data residency reasons. That is a legitimate and increasingly common choice. But it comes with a trade-off that this vulnerability makes concrete: when you self-host for sovereignty, there is no cloud provider quietly patching the flaw server-side while you are not looking. Every critical CVE in your self-hosted automation stack is now your patch window, your exposure, and your responsibility to track. For a platform that, by design, often has broad credentials and API access wired into dozens of internal and external systems, an RCE in the workflow engine itself is a direct path to whatever those workflows can reach.
If your organisation self-hosts n8n or any other workflow automation platform and needs a faster, more reliable patch management process, a review of who actually has workflow-edit rights and what those workflows can reach, or help deciding when self-hosting for data sovereignty is worth the operational burden it creates, contact Excello Digital. We help European teams run self-hosted automation and DevOps tooling securely, without trading SaaS dependency for an unmanaged patching backlog.