Multiple critical vulnerabilities in the n8n workflow automation platform expose organizations to severe compromise scenarios by allowing authenticated users with workflow permissions to escape the application sandbox and execute arbitrary system commands on the host server. The flaw attack chain, collectively tracked as CVE-2026-25049, stems from inadequate sanitization and incomplete AST-based sandboxing of user-written JavaScript expressions, effectively bypassing protections introduced for the earlier CVE-2025-68613 and highlighting a deeper mismatch between TypeScript’s compile-time checks and JavaScript’s runtime behavior that attackers can exploit to evade security controls. Researchers demonstrated that successful exploitation could grant filesystem access, enable credential and API key theft, facilitate lateral movement into internal and cloud environments, hijack AI workflows, and potentially expose data across tenants in multi-tenant deployments (particularly when combined with publicly accessible webhooks that allow remote triggering of malicious workflows). Security experts state that “if you can create a workflow, you can own the server,” underscoring the low barrier to exploitation once privileges are obtained. Additional critical flaws (including command injection in the Git node, arbitrary file write via the Merge node, stored cross-site scripting enabling session hijacking, and a path traversal bug that could lead to RCE on downstream systems) further expand the attack surface and reinforce concerns about systemic input validation weaknesses within automation features. Although there are no confirmed reports of widespread exploitation, researchers caution that workflow automation platforms increasingly represent high-value infrastructure targets due to their deep integrations with sensitive systems and credentials. CTIX analysts strongly advise organizations to upgrade to patched versions (1.123.17 and 2.5.2 or later), rotate encryption keys and stored secrets, audit workflows for suspicious expressions, restrict workflow creation to trusted users, and deploy hardened environments to reduce the likelihood and impact of compromise.