n8n: N8n's JavaScript task runner shared a single module cache across all users' Code-node executions
n8n
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-72764
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- August 11, 2026
- Source last modified
- October 24, 2026
Description
n8n's JavaScript task runner shared a single module cache across all users' Code-node executions. In affected versions (before 1.123.67, 2.31.5, and 2.32.1), a user able to run a Code node could poison a cached module and thereby alter other users' Code-node executions on the same runner, affecting their confidentiality, integrity, or availability. This is a cross-user isolation break within a single n8n instance and does not constitute a sandbox escape or remote code execution. Only multi-user instances running the JS task runner with built-in or external modules enabled are affected.
Description quoted from the NVD record.
Who is affected
n8n is a tool for automating tasks by connecting apps and services into workflows. This flaw affects versions before 1.123.67, 2.31.5, and 2.32.1, but only on setups with more than one user that run code through n8n's JavaScript task runner with built-in or external code modules turned on. In those setups, a user who can run a Code node (the workflow step that runs custom JavaScript) could tamper with shared code the runner stores for reuse and change how other users' Code nodes behave. That could expose their data, alter their results or stop their workflows from working. This flaw is rated High.
What to do
- If someone in your organization installed and runs n8n, that person should check which version is in use and whether more than one person uses it.
- That person should update n8n to a fixed version:
1.123.67,2.31.5or2.32.1, choosing the one that matches the release series you already use. - If an IT provider or vendor runs n8n for your organization, send them this advisory and ask when the update will be done.
- For full details on the fixed releases, see the vendor advisory linked on this page.
Analysis written from the source record as of October 24, 2026 and reviewed before publishing.