n8n Sandbox Escape: Workflow Editor Could Run OS Commands

The n8n developers have shipped a fix for a vulnerability that allowed an attacker to break out of the expression sandbox and execute arbitrary operating-system commands on the server running the automation platform. The issue was discovered by researchers at Security Joes while they were studying February's patch for CVE-2026-27577 in search of a new bypass — and they found one.

What's affected

The vulnerability affects versions prior to 2.31.5, as well as the range from 2.32.0 through 2.32.1. Fixes were released in 2.31.5 and 2.32.1. The identifier is GHSA-gv7g-jm28-cr3m, with a CVSS 4.0 score of 8.7 (High); as of July 27, 2026 no separate CVE has been assigned. There is no patch for the 1.x branch in the list, and the advisory does not say whether n8n Cloud was affected.

Administrators are advised to upgrade rather than rely on stopgap measures such as restricting access to the instance and limiting workflow editing to trusted users — the vendor itself calls these measures incomplete.

How it works

n8n expressions of the form ={{ $json.email }} are processed by a syntax-tree rewriter: it redirects free JavaScript identifiers into a controlled data context rather than into the Node.js environment. In version 2.31.4, the file VariablePolyfill.ts left arrow functions in a stub branch. As a result, a shorthand such as () => process returned the real global process object instead of the sandboxed substitute.

The second flaw was hidden in the property checks: they analyzed static names, whereas Reflect.get() receives the requested property as a function argument. By combining both oversights, the researchers reached process.getBuiltinModule, loaded child_process, and executed a command on the host. As the Security Joes team noted, “neither condition triggers on its own — and neither was covered by tests.”

What it means

Exploitation requires only a valid account with the right to create or modify workflows and needs no involvement from another user. A successful attack yields command execution with the privileges of the n8n process. This opens access to the N8N_ENCRYPTION_KEY key, and thus to decrypting stored credentials, as well as to connected databases, internal services, and cloud endpoints. No cases of exploitation in the wild had been recorded as of the report's preparation.

The residual flaw was found on July 14 and reported on July 15; the fixed builds were released on July 22. Defenders are advised to review recently created or modified workflows for suspicious arrow functions and obfuscated JavaScript, and to look for shells, PowerShell, curl, or wget being launched as child processes of n8n or Node.js.

The find continues a series of expression-sandbox escapes that n8n has been closing since 2025; the previous one was CVE-2026-27577, scored 9.4, which was fixed in February.

Source: The Hacker News