CVE-2026-85165 in n8n
Summary
by MITRE • 09/03/2026
n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, or class-extension positions resolve against process globals. Authenticated users with workflow-edit permission can mutate host objects through expression evaluation, with changes persisting process-wide until restart.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/03/2026
The n8n automation platform prior to version 2.36.2 contains a critical security flaw classified as an Expression Sandbox Bypass vulnerability. This issue stems from insufficient isolation within the JavaScript execution environment used for evaluating workflow expressions. In standard secure implementations, sandboxed environments restrict access to global objects such as process, console, and module to prevent code injection attacks. However, in affected versions of n8n, specific syntactic constructs allow attackers to bypass these restrictions by resolving free identifiers against host globals rather than the intended isolated scope. This architectural weakness effectively neutralizes the protective barriers designed to contain malicious script execution within the workflow engine.
The technical mechanism behind this vulnerability involves several distinct code patterns that fail to properly sanitize or isolate variable resolution. Specifically, when expressions utilize spread operators in object literals, computed property keys, switch-case default clauses, or class extension statements, the interpreter incorrectly resolves undefined identifiers against the Node.js process global context. This behavior deviates from expected sandboxed execution where all external references should be blocked or strictly controlled. By leveraging these specific syntax positions, an attacker can inject code that accesses sensitive host environment variables, file system paths, and internal module structures without triggering standard security warnings or access denials.
The operational impact of this vulnerability is severe due to the persistence of state changes across the entire process lifecycle. Authenticated users possessing workflow-edit permissions are able to exploit this flaw by crafting malicious workflows containing specially constructed expressions. Upon execution, these expressions mutate host objects and environment variables in a way that persists until the n8n server instance is restarted. This means that an attacker does not need repeated access or continuous exploitation; a single successful evaluation can alter system behavior permanently for all subsequent operations. The ability to modify global state allows for potential data exfiltration, privilege escalation within the application context, and disruption of other workflows running on the same instance by corrupting shared variables or configuration objects.
This vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) as it involves the injection of executable code into a host environment through manipulated input parameters. Furthermore, from an offensive security perspective, this technique maps to MITRE ATT&CK techniques related to Command and Scripting Interpreter abuse, specifically T1059 which covers command execution via scripting languages like JavaScript or Node.js. The persistence aspect also relates to mechanisms that allow attackers to maintain access by modifying system configurations without requiring elevated privileges for each action.
Mitigation strategies must prioritize immediate software updates as the primary defense vector. Organizations running n8n should upgrade to version 2.36.2 or later, where this sandbox bypass has been patched and proper isolation of expression evaluation contexts is enforced. For environments that cannot be updated immediately due to operational constraints, implementing strict network segmentation can limit exposure by restricting access to the n8n interface only from trusted internal networks. Additionally, enforcing least-privilege principles for user accounts ensures that workflow-edit permissions are granted solely to users who require them, thereby reducing the attack surface available to potential adversaries. Monitoring logs for unusual expression evaluations or unexpected changes in environment variables can also aid in early detection of exploitation attempts before significant damage occurs.