CVE-2026-86076 in n8n
Summary
by MITRE • 09/09/2026
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the expression compiler sanitizer resolved through dynamically scoped this and did not reject reserved class member names. A class field named __sanitize could rebind the sanitizer and reach the Function constructor, enabling backend code execution and editor-preview JavaScript execution. The affected AST hook is PrototypeSanitizer in packages/workflow/src/expression-sandboxing.ts. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified within the n8n workflow automation platform represents a critical flaw in its expression compiler sanitizer logic, specifically affecting versions prior to 1.123.76 for version 1.x branches, as well as versions before 2.37.7 and 2.38.2 for the 2.x series. This security issue stems from an improper handling of dynamic scoping within the JavaScript execution environment used by n8n to evaluate user-defined expressions. The core technical flaw lies in how the sanitizer resolves the this context during expression evaluation, allowing a malicious actor to manipulate the scope chain and bypass intended restrictions on object property access.
At the heart of the vulnerability is the PrototypeSanitizer component located in packages/workflow/src/expression-sandboxing.ts. This module is responsible for restricting access to dangerous JavaScript prototypes and methods that could lead to arbitrary code execution. However, due to a flaw in how dynamically scoped this values are resolved, an attacker can exploit reserved class member names to rebind the sanitizer itself. By crafting a specific expression that targets the __sanitize property of a class field, it is possible to overwrite or redirect the reference to the sanitization logic. This rebinding effectively neutralizes the protective measures put in place by the sandboxing engine, leaving the execution environment exposed to unrestricted JavaScript operations.
The operational impact of this vulnerability is severe, as it enables backend code execution and allows for arbitrary JavaScript execution within the editor-preview functionality. Since n8n often runs with elevated privileges or access to sensitive internal services such as databases, APIs, and cloud storage integrations, successful exploitation can lead to a complete compromise of the underlying infrastructure. An attacker could inject malicious payloads that exfiltrate data, modify workflows, install backdoors, or pivot further into the network. The ability to execute code in the editor-preview context also poses a risk during workflow design phases, potentially affecting users who preview their automation logic before deployment.
This vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) and specifically relates to CWE-75 Failure to Sanitize Data into Custom Language due to insufficient validation or encoding of input data that is used in a dynamic code generation context. From an offensive security perspective, the exploitation technique maps to MITRE ATT&CK techniques such as T1059 Command and Scripting Interpreter for executing arbitrary scripts and potentially T1203 Exploitation for Client Execution if the vulnerability can be triggered through client-side interactions like previewing workflows in a web interface. The attack vector typically involves injecting malicious expressions into workflow nodes that support dynamic input fields, leveraging the platform's own expression evaluation engine against itself.
Mitigation strategies primarily involve upgrading to patched versions of n8n immediately. Administrators should ensure they are running version 1.123.76 or later for legacy branches, and version 2.37.7 or 2.38.2 or later for current releases where the PrototypeSanitizer logic has been hardened to correctly handle dynamic scoping and reject attempts to rebind sanitizer properties. In environments where immediate patching is not feasible, network-level controls such as web application firewalls can be configured to detect and block suspicious expression patterns that attempt to access reserved identifiers like __sanitize or manipulate prototype chains. Additionally, restricting the privileges of the n8n service account limits the blast radius in case a successful exploitation occurs, ensuring that even if code execution is achieved, it cannot perform high-impact actions on the host system or connected services.