n8n Sandbox Escape Allows Workflow Editors to Execute OS Commands
n8n has patched a critical sandbox escape vulnerability (CVE-2026-27577 bypass) that allowed authenticated workflow editors to execute arbitrary OS commands on the server.
n8n has released patches for a critical sandbox escape vulnerability that could allow authenticated workflow editors to execute operating-system commands on the server running the automation platform. The flaw, discovered by Security Joes, affects versions prior to 2.31.5 and between 2.32.0 and 2.32.1. n8n has addressed this in versions 2.31.5 and 2.32.1.
The vulnerability, tracked as GHSA-gv7g-jm28-cr3m, is rated High with a CVSS 4.0 score of 8.7. While no official CVE had been assigned as of July 27, 2026, it represents a significant risk to deployments.
Exploitation requires a valid account with permissions to create or modify workflows, but does not necessitate any action from another user. A successful exploit would execute commands with the privileges of the n8n process itself, potentially leading to the exposure of sensitive information such as the N8N_ENCRYPTION_KEY, enabling decryption of stored credentials, or providing pathways to connected databases, internal services, and cloud endpoints.
Security Joes identified two key weaknesses that enabled this exploit. The first involved an issue in n8n's abstract syntax tree rewriter, which is designed to redirect JavaScript identifiers in expressions to n8n's controlled data context. In version 2.31.4, a specific handling of ArrowFunctionExpression allowed the process identifier to resolve to the actual Node.js global object instead of the sandboxed value.
The second blind spot exploited was in n8n's property checks, which typically inspect static property names in member expressions. Researchers leveraged the behavior of Reflect.get() to recover process.getBuiltinModule, which allowed them to load the child_process module and subsequently execute arbitrary commands on the host system.
Researchers reported the vulnerability on July 15, and n8n published the fixed releases on July 22. Administrators are strongly advised to update to the patched versions. Interim guidance from n8n suggests restricting instance access and workflow editing to fully trusted users, but these controls are described as incomplete and short-term mitigations.
Defenders should review recently created or modified workflows for unexpected arrow functions or obfuscated JavaScript. Additionally, they should hunt for suspicious processes like shells, PowerShell, curl, or wget spawned as children of the n8n or Node.js process. In cases where suspicious activity is found, credentials should be rotated immediately.
This finding continues a trend of expression-sandbox escapes that n8n has been patching since 2025, following a similar critical vulnerability (CVE-2026-27577) discovered earlier in the year.