n8n module cache poisoning in JavaScript Task Runner

Executive brief

n8n is a workflow automation tool that allows users to run custom JavaScript code. A security flaw in the JavaScript task runner allowed different users on the same system to interfere with each other's code by corrupting a shared memory cache. This could allow one user to secretly modify or steal data from another user's automated tasks.

Technical details

A cross-tenant isolation vulnerability exists in n8n's JavaScript task runner due to a shared module cache across different users' Code-node executions. An attacker with low privileges (the ability to execute a Code node) can perform module cache poisoning. By modifying a cached module, the attacker can alter the behavior of subsequent executions by other users on the same runner. This breaks cross-user isolation within a single instance, potentially compromising the confidentiality and integrity of other users' workflows. The issue is fixed in versions 1.123.67, 2.31.5, and 2.32.1.

Affected products

• n8n-io n8n < 1.123.67, >= 2.0.0-rc.0 < 2.31.5, >= 2.32.0 < 2.32.1

Timeline

• 2026-07-22: disclosed
• 2026-07-22: advisory
• 2026-07-22: patched

References

• https://api.github.com/users/thesecguy45
• https://github.com/thesecguy45
• https://api.github.com/users/thesecguy45/gists%7B/gist_id%7D
• https://api.github.com/users/thesecguy45/repos
• https://avatars.githubusercontent.com/u/227870317?v=4
• https://api.github.com/users/thesecguy45/events%7B/privacy%7D