n8n Sandbox Escape Lets Workflow Editors Run OS Commands as the n8n Process
n8n has patched a high-severity expression-sandbox escape that could let an authenticated workflow editor execute operating-system commands on the server running the automation platform.
Intelligence analysis by Llama
A high-severity expression-sandbox escape in n8n could let an authenticated workflow editor execute operating-system commands on the server running the automation platform. The flaw was patched in versions 2.31.5 and 2.32.1.
Imagine you're working on a project with a friend, and you both have special permissions to make changes. But what if someone could sneak in and do things you're not supposed to do, like access your secret passwords or run commands on the computer? That's what happened with n8n, a tool that helps people automate tasks. A group of researchers found a way to do this, but n8n fixed the problem before it could be used for bad things.
Analysis
A Critical Flaw in n8n's Sandbox Escape
n8n has patched a high-severity expression-sandbox escape that could let an authenticated workflow editor execute operating-system commands on the server running the automation platform. This flaw was discovered by Security Joes, a research team that initially estimated the vulnerability would land near the 9.4 Critical rating of CVE-2026-27577.
The affected ranges are <2.31.5 and >=2.32.0,<2.32.1 . n8n fixed the flaw in versions 2.31.5 and 2.32.1 . It tracks the issue as GHSA-gv7g-jm28-cr3m , rates it High with a CVSS 4.0 score of 8.7, and no CVE had been assigned as of July 27, 2026.
Administrators should update rather than rely on n8n's interim guidance to restrict instance access and workflow editing to fully trusted users. The advisory describes those controls as incomplete, short-term mitigations. It lists no patched 1.x release and does not say whether n8n Cloud was affected.
How the Flaw Was Exploited
Exploitation requires a valid account with permission to create or modify workflows. It does not require action from another user. A successful exploit executes commands with the privileges of the n8n process. Security Joes, in a report shared with The Hacker News, said that access could expose N8N_ENCRYPTION_KEY and allow decryption of credentials stored in n8n. It could also open paths to connected databases, internal services, and cloud endpoints.
The Root Cause of the Flaw
The researchers identified two conditions that its exploit relied on. The first blind spot was in n8n's property checks, which inspect static property names in member expressions. Reflect.get() receives the requested property as a function argument. The researchers used that distinction to recover process.getBuiltinModule , load child_process , and run a command on the host.
The second blind spot was in n8n's property checks, which inspect static property names in member expressions. Reflect.get() receives the requested property as a function argument. The researchers used that distinction to recover process.getBuiltinModule , load child_process , and run a command on the host.
The Fix and What to Do Next
The fixed rewriter adds a dedicated ArrowFunctionExpression handler that routes a bare identifier in a concise arrow body through the data context. "Neither alone is sufficient. Neither was covered by tests," Security Joes' research team said of the two conditions its exploit relied on.
Defenders should review recently created or modified workflows for unexpected arrow functions or obfuscated JavaScript. They should also hunt for shells, PowerShell, curl , or wget spawned as children of the n8n or Node.js process. Credentials should be rotated where suspicious workflow execution or host command activity is found.
Key points
- n8n has patched a high-severity expression-sandbox escape that could let an authenticated workflow editor execute operating-system commands on the server running the automation platform.
- The flaw was patched in versions 2.31.5 and 2.32.1.
- Administrators should update rather than rely on n8n's interim guidance to restrict instance access and workflow editing to fully trusted users.
- The advisory describes those controls as incomplete, short-term mitigations.
- It lists no patched 1.x release and does not say whether n8n Cloud was affected.
If n8n's fix is effective, this vulnerability will not be exploited, and users will be able to safely use the platform without worrying about their sensitive information being compromised.
However, if the fix is not fully effective, or if users do not update their n8n instances, this vulnerability could still be exploited, leading to further security risks and potential data breaches.
