# CVE-2026-86083: n8n expression sandbox escape in legacy engine via JSON.stringify tampering

Source: https://junglewise.ai/threats/cve-2026-86083-n8n-expression-sandbox-escape-in-legacy-engine-via-json-stringify  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-86083 · Severity: high · CVSS 8.8 · Published 2026-09-08

n8n is a workflow automation platform that allows users to create and execute complex data processing pipelines. The legacy expression engine in n8n contains a vulnerability where malicious expressions can tamper with the global JSON.stringify function during code generation, allowing attackers to inject arbitrary executable code. An authenticated user with access to the platform can exploit this to achieve remote code execution on the n8n server.

Technologies: [n8n (npm)](https://junglewise.ai/threats/technologies/npm-n8n). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-86083 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86083 being exploited in the wild.

**How severe is CVE-2026-86083?** High severity, with a CVSS score of 8.8, published 8 September 2026.

**Which products and versions are affected?** n8n (npm) SEMVER:introduced=0,fixed=1.123.76.

**Is there a fix for CVE-2026-86083?** Yes. n8n (npm): upgrade to 1.123.76 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86083 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-86083?** Check whether you run n8n (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- n8n (npm): upgrade to 1.123.76 or later

  ```sh
  npm install n8n@1.123.76
  ```


## Technical details

The vulnerability is a code injection flaw (CWE-94) affecting n8n's legacy expression engine. During expression code generation, two stages call the global JSON.stringify function: the compiler when printing synthetic string literals, and the isolate bridge when interpolating timezone values into per-evaluation wrappers. An attacker can craft an expression that replaces the global JSON.stringify, causing the code-generation stages to produce malicious executable source code instead of literal data. The attack requires low privileges (authenticated user) and network access to the n8n instance. The vm expression engine (default in patched versions) is not affected. The fix captures a reference to JSON.stringify at module load time, preventing later global state modifications from altering generated code.

## Affected products

- n8n n8n < 1.123.76, >= 2.0.0 < 2.37.7, >= 2.38.0 < 2.38.2

## Identifiers

- CVE-2026-86083
- GHSA-6xcw-7xm6-48c6

## Timeline

- 2026-09-10: disclosed: Vulnerability published on GitHub Advisory Database
- 2026-09-10: patched: Patches released: n8n 1.123.76, 2.37.7, and 2.38.2

## References

- [https://api.github.com/users/hiddingtrojans](https://api.github.com/users/hiddingtrojans)
- [https://github.com/hiddingtrojans](https://github.com/hiddingtrojans)
- [https://api.github.com/users/hiddingtrojans/gists%7B/gist_id%7D](https://api.github.com/users/hiddingtrojans/gists%7B/gist_id%7D)
- [https://api.github.com/users/hiddingtrojans/repos](https://api.github.com/users/hiddingtrojans/repos)
- [https://avatars.githubusercontent.com/u/107155157?v=4](https://avatars.githubusercontent.com/u/107155157?v=4)
- [https://api.github.com/users/hiddingtrojans/events%7B/privacy%7D](https://api.github.com/users/hiddingtrojans/events%7B/privacy%7D)

## Related threats

- [n8n Agent Workflow Tool bypasses Sub-Workflow Caller Policy](https://junglewise.ai/threats/cve-2026-86996-n8n-agent-workflow-tool-bypasses-sub-workflow-caller-policy)
- [n8n Git Node config bypass enables local repository read](https://junglewise.ai/threats/cve-2026-86995-n8n-git-node-config-bypass-enables-local-repository-read)
- [n8n missing authorization in active workflows endpoint](https://junglewise.ai/threats/cve-2026-86994-n8n-missing-authorization-in-active-workflows-endpoint)
- [n8n log streaming credentials unauthorized access](https://junglewise.ai/threats/cve-2026-86993-n8n-log-streaming-credentials-unauthorized-access)
- [n8n missing authorization in role assignment endpoints](https://junglewise.ai/threats/cve-2026-86085-n8n-missing-authorization-in-role-assignment-endpoints)