CVE-2026-27493 | n8n-io n8n up to 1.123.21/2.9.2/2.10.0 Environment Variable NODES_EXCLUDE code injection (ID 19)

A vulnerability, which was classified as critical, has been found in n8n-io n8n up to 1.123.21/2.9.2/2.10.0. The impacted element is an unknown function of the component Environment Variable Handler. The manipulation of the argument NODES_EXCLUDE leads to code injection.

This vulnerability is referenced as CVE-2026-27493. Remote exploitation of the attack is possible. No exploit is available.

It is advisable to upgrade the affected component.