Ni8mare — n8n Unauthenticated RCE (CVSS 10.0)

Ni8mare is the most critical vulnerability ever discovered in n8n, scoring a perfect CVSS 10.0. It allows completely unauthenticated Remote Code Execution with sandbox escape.

## Vulnerability Overview
A catastrophic content/form validation flaw in n8n allows an unauthenticated attacker to achieve Remote Code Execution by sending specially crafted requests to the n8n webhook/form endpoints. The vulnerability requires no authentication, no user interaction, and provides full sandbox escape.

## Technical Details
- **CVSS Score:** 10.0 — the highest possible severity
- **Type:** Code Injection via Form/Content Validation Bypass (CWE-94)
- **Root Cause:** The n8n Form Trigger and Webhook nodes accept user input that is processed by the expression evaluation engine without proper sanitization. An attacker can inject JavaScript expressions through form fields that are evaluated server-side with full Node.js access.
- **Authentication:** NONE required
- **User Interaction:** NONE required
- **Scope:** Changed — the attacker can escape the n8n sandbox and affect the host system

## Attack Scenario
1. Attacker identifies an n8n instance with any webhook or form trigger endpoint exposed.
2. Attacker sends a crafted HTTP request with expression injection in form/webhook data.
3. n8n's expression engine evaluates the injected code.
4. The sandbox is bypassed, achieving full RCE on the host.

## Impact
- Complete server compromise without any credentials
- Access to all n8n workflows, credentials, and connected services
- Lateral movement to all integrated systems
- Potential for worm-like propagation across n8n instances

## Urgency
This vulnerability has the highest possible severity. All n8n instances should be patched immediately or taken offline until patched.