n8n: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code Execution
n8n
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-86076
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- September 8, 2026
- Source last modified
- September 11, 2026
Description
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the expression compiler sanitizer resolved through dynamically scoped this and did not reject reserved class member names. A class field named __sanitize could rebind the sanitizer and reach the Function constructor, enabling backend code execution and editor-preview JavaScript execution. The affected AST hook is PrototypeSanitizer in packages/workflow/src/expression-sandboxing.ts. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.
Description quoted from the NVD record.
Who is affected
n8n is a platform for automating tasks by connecting different apps and services into workflows. This flaw affects n8n versions earlier than 1.123.76, 2.37.7 and 2.38.2. The problem is in the safety check n8n uses when it runs expressions, the small formulas people write inside workflows. A specially written expression can get around that check. This lets an attacker run their own code on the server that hosts n8n and run code in the preview inside the workflow editor. This flaw is rated High.
What to do
- If your organization installed and runs n8n itself, ask the person who set it up to check which version is in use.
- That person should update n8n to one of the fixed versions:
1.123.76,2.37.7or2.38.2. The vendor advisory linked on this page can help you choose the right one for your setup. - If an IT provider or vendor runs n8n for your organization, send them this advisory and ask when the update will be done.
Analysis written from the source record as of September 11, 2026 and reviewed before publishing.