CVE-2026-86076: n8n: Expression Sandbox Escape in Editor-UI Enables Stored Cross-User JavaScript Execution
Impact
The expression compiler's sanitizer resolved through a dynamically-scoped this, so a class field named sanitize rebound it and reached the Function constructor. On the backend, any expression author could run code in the n8n process; in the editor preview, a member's expression could run as JavaScript in the session of whoever opened the workflow. The patch rejects reserved class-member names.
Patches
The issue has been fixed in n8n versions 1.123.76, 2.37.7, and 2.38.2. Users should upgrade to one of these versions or later to remediate the vulnerability.
Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict n8n instance access to fully trusted users only. - Avoid granting workflow-create or workflow-edit permissions to untrusted users. - Audit existing workflows for unexpected or unfamiliar expressions in node parameters. - Set N8NEXPRESSIONENGINE=vm.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Other sources
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the expression compiler sanitizer resolved through dynamically scoped this and did not reject reserved class member names. A class field named sanitize could rebind the sanitizer and reach the Function constructor, enabling backend code execution and editor-preview JavaScript execution. The affected AST hook is PrototypeSanitizer in packages/workflow/src/expression-sandboxing.ts. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 2.37.7 - Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 2.38.2 - Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 1.123.76 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 1.123.76 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.37.7 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.38.2 - Configuration
Set N8N_EXPRESSION_ENGINE=vm to use the vm expression engine as a temporary mitigation while upgrading is not immediately possible.
n8n N8N_EXPRESSION_ENGINE = vm - Compensating control
Audit existing workflows for unexpected or unfamiliar expressions in node parameters.
- Compensating control
Avoid granting workflow-create or workflow-edit permissions to untrusted users.
- Compensating control
Restrict n8n instance access to fully trusted users only.
Event History
Frequently Asked Questions
Which n8n versions need to be updated?
Versions earlier than 1.123.76, 2.37.7, and 2.38.2 are affected. Upgrade to the applicable fixed version for your release line.
What capabilities could exploitation provide?
A crafted expression can escape the expression compiler sanitizer by rebinding it through a class field named __sanitize and reaching the Function constructor. This can enable backend code execution and JavaScript execution in editor previews for other users.
What component should be reviewed when assessing exposure?
The affected sanitizer hook is PrototypeSanitizer in packages/workflow/src/expression-sandboxing.ts. Environments using the vulnerable expression compiler behavior should be considered exposed until updated.