Executive brief
n8n is a popular workflow automation tool used to connect different software services. A security vulnerability allows an authorized user to bypass safety restrictions by using specially crafted code expressions. This could allow an attacker to execute unauthorized commands directly on the server hosting the n8n application, potentially leading to a full system takeover or data theft.
Technical details
A sandbox escape vulnerability exists in n8n's expression evaluation engine. Authenticated users with workflow creation or modification privileges can bypass the expression sandbox by utilizing crafted JavaScript arrow functions. This bypass allows for arbitrary system command execution (RCE) on the host operating system. The vulnerability is classified as Code Injection (CWE-94) and has been addressed by improving the validation of function bodies within the sandbox. Patches are available in versions 2.31.5 and 2.32.1.
Affected products
- n8n-io n8n < 2.31.5, >= 2.32.0 < 2.32.1
Timeline
- 2026-07-22: disclosed
- 2026-07-22: patched
- 2026-07-22: advisory
References
- https://github.com/n8n-io/n8n/security/advisories/GHSA-gv7g-jm28-cr3m
- https://github.com/n8n-io/n8n/commit/f69dfc6dd2178a14ea1624d2e1d403c2e755042f
- https://github.com/n8n-io/n8n/releases/tag/n8n@2.31.5
- https://github.com/n8n-io/n8n/releases/tag/n8n@2.32.1
- https://api.github.com/repos/n8n-io/n8n/security-advisories/GHSA-gv7g-jm28-cr3m