n8n Sandbox Escape Lets Workflow Editors Run OS Commands as the n8n Process

n8n has patched a high-severity expression-sandbox escape that could let an authenticated workflow editor execute operating-system commands on the server running the automation platform. Security Joes found the flaw while probing n8n’s February fix for CVE-2026-27577 for another bypass.

The affected ranges are <2.31.5 and >=2.32.0,<2.32.1. n8n fixed the flaw in versions 2.31.5 and 2.32.1. It tracks the issue as GHSA-gv7g-jm28-cr3m, rates it High with a CVSS 4.0 score of 8.7, and no CVE had been assigned as of July 27, 2026.

Administrators should update rather than rely on n8n’s interim guidance to restrict instance access and workflow editing to fully trusted users. The advisory describes those controls as incomplete, short-term mitigations. It lists no patched 1.x release and does not say whether n8n Cloud was affected.

Exploitation requires a valid account with permission to create or modify workflows. It does not require action from another user. A successful exploit executes commands with the privileges of the n8n process.

Security Joes, in a report shared with The Hacker News, said that access could expose N8N_ENCRYPTION_KEY and allow decryption of credentials stored in n8n. It could also open paths to connected databases, internal services, and cloud endpoints. The firm had not observed exploitation in the wild when its report was prepared. The public advisory does not say whether the flaw was exploited before the fix.

n8n workflow builders use expressions such as ={{ $json.email }}. An abstract syntax tree rewriter redirects free JavaScript identifiers in those expressions to n8n’s controlled data context rather than the Node.js runtime. In version 2.31.4, VariablePolyfill.ts placed ArrowFunctionExpression in an explicit no-op branch. A concise arrow body such as () => process could therefore resolve process to the real Node.js global instead of the sandboxed value.

The second blind spot, Security Joes said, was in n8n’s property checks, which inspect static property names in member expressions. Reflect.get() receives the requested property as a function argument. The researchers used that distinction to recover process.getBuiltinModule, load child_process, and run a command on the host.

They tested the proof-of-concept against n8n 2.30.4 through both the released workflow package and a local n8n instance.

A comparison of the public 2.31.4 and 2.31.5 source files confirms the arrow-function gap. It does not independently confirm the complete Reflect.get() exploit chain described in Security Joes’ report. The fixed rewriter adds a dedicated ArrowFunctionExpression handler that routes a bare identifier in a concise arrow body through the data context.

“Neither alone is sufficient. Neither was covered by tests,” Security Joes’ research team said of the two conditions its exploit relied on. Security Joes initially estimated the flaw would land near the 9.4 Critical rating of CVE-2026-27577; the vendor’s published 8.7 is the current score.