n8n: N8n before 2.31.5 and before 2.32.1 contain a sandbox escape vulnerability in expression…
n8n
- Severity
- Critical, CVSS 9.9
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Record
- CVE-2026-72765
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- August 11, 2026
- Source last modified
- October 24, 2026
Description
n8n before 2.31.5 and before 2.32.1 contain a sandbox escape vulnerability in expression evaluation. An authenticated user with permission to create or modify workflows can craft expressions using arrow-function bodies to bypass the expression sandbox, triggering system command execution on the host running n8n. The issue is fixed in versions 2.31.5 and 2.32.1.
Description quoted from the NVD record.
Who is affected
This problem affects n8n, a tool that connects different apps and automates routine tasks through workflows. This flaw affects versions before 2.31.5 and before 2.32.1. It sits in the part of n8n that works out expressions (small formulas written inside workflows). A person who has an n8n login and permission to create or change workflows could write a specially crafted expression that slips past the safety barrier meant to contain expressions. That would let them run commands on the computer that hosts n8n. This flaw is rated Critical.
What to do
- If someone in your organization installed and runs n8n, that person should check which version of n8n is in use on your systems.
- That person should update n8n to version
2.31.5or2.32.1, the versions in which this flaw is fixed. - If an IT provider or vendor runs n8n for your organization, send them this advisory and ask when the update will be done.
- For details on the fixed releases, read the vendor advisory linked on this page.
Analysis written from the source record as of October 24, 2026 and reviewed before publishing.