CVE-2026-77077: n8n before 1.123.69 Remote Code Execution via EventEmitter Prototype Pollution
n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis functions but not internal module constructors such as EventEmitter, allowing an authenticated user with Code node access to exploit prototype pollution to execute arbitrary commands within the runner container. Because the polluted prototype is a process-wide object, the corruption persists across other tenants' Code node executions on the same shared runner. On v1.x instances without task runners enabled, Code node JavaScript runs directly in the main n8n process, where the impact could be higher.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 1.123.69 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.33.4 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.34.1 - Compensating control
Use isolated/shared-runner separation so that a prototype-pollution compromise in one tenant cannot persist across other tenants’ Code node executions on the same shared runner.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who has access to the Code node can exploit it. In shared-runner deployments, one tenant's prototype pollution can affect other tenants' Code node executions on that same runner.
Are instances using the default execution model affected?
The issue affects the JavaScript task runner VM sandbox in versions before 1.123.69, 2.33.4, and 2.34.1. On v1.x instances where task runners are not enabled, Code node JavaScript executes directly in the main n8n process, potentially increasing the impact.
What is the immediate mitigation if an update cannot be applied?
The provided information identifies Code node access as a prerequisite for exploitation. Restricting access to the Code node can reduce exposure until the affected n8n version can be updated.