CVE-2026-72765: n8n before 2.32.1 Remote Code Execution via Expression Sandbox Escape
n8n before 2.31.5 and before 2.32.1 contain a sandbox escape vulnerability in expression evaluation. An authenticated user with permission to create or modify workflows can craft expressions using arrow-function bodies to bypass the expression sandbox, triggering system command execution on the host running n8n. The issue is fixed in versions 2.31.5 and 2.32.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.31.5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.32.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72765?
CVE-2026-72765 has a severity score of 77, indicating a high risk of impact.
How do I fix CVE-2026-72765?
To mitigate CVE-2026-72765, upgrade n8n to version 2.32.1 or later.
What type of vulnerability is CVE-2026-72765?
CVE-2026-72765 is classified as a Code Injection vulnerability.
Who is affected by CVE-2026-72765?
CVE-2026-72765 affects all versions of n8n prior to 2.32.1.
What can an attacker do with CVE-2026-72765?
An attacker can exploit CVE-2026-72765 to execute arbitrary system commands on the host machine.