Executive brief
n8n is a workflow automation platform that allows users to create and run automated tasks. An authenticated attacker with workflow creation privileges can escape the JavaScript Code node's security sandbox by modifying the Function prototype, gaining access to the host system's underlying resources. Depending on what external modules are configured as allowed imports, this could enable full system compromise including data theft and code execution.
Technical details
The vulnerability is a prototype pollution attack on the JavaScript VM sandbox used by n8n's Code node. The root cause is that the sandbox's Function.prototype was not frozen, allowing an authenticated attacker to inject malicious code into a Code node execution that pollutes the Function prototype and recovers a reference to the host's globalThis object, thereby breaking out of the sandbox. Attack vector is network-based and requires authentication plus the ability to create and execute workflows; it also depends on specific allowlisted modules being configured. A successful exploit grants the attacker access to the host environment with the same privileges as the n8n task runner process. Patches are available in n8n versions 1.123.69, 2.33.4, and 2.34.1.
Affected products
- n8n n8n prior to 1.123.69, 2.33.4, and 2.34.1
Timeline
- 2026-08-20: disclosed: Published on NVD and GitHub Security Advisory
- 2026-08-20: patched: Fixed in versions 1.123.69, 2.33.4, and 2.34.1