n8n CVE-2026-72765

Exploitation requires two simultaneous conditions: an authenticated n8n session (CVSS PR:L confirms authentication is mandatory) and explicit permission to create or modify workflows within that session - read-only users or accounts without workflow editor rights cannot trigger the vulnerable code path. No additional non-default configuration is required beyond having an account with those permissions; the vulnerability exists in the core expression evaluator used by all n8n workflow instances. The attack is network-delivered (AV:N), requires no elevated privileges beyond workflow editor access, and involves no additional user interaction (UI:N). What limits exploitation is the workflow-editor permission gate: in single-user self-hosted deployments or environments where only administrators have workflow access, the practical risk is lower. In team deployments, SaaS-style instances, or any environment where multiple users hold workflow editor permissions, every such user is a potential attacker.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H indicates a high-severity, low-friction exploit path: network-accessible, no attack complexity, no targeted configuration required, and full impact on the vulnerable system. The primary constraint is PR:L - exploitation is gated behind a valid n8n account with workflow editor permissions, which materially reduces the exploitable population compared to an unauthenticated flaw. In tightly administered single-user or small-team deployments, that gating significantly limits real-world risk; in shared or multi-tenant instances where workflow permissions are broadly granted, the threat surface is substantially larger. No EPSS score was provided in the available data, and the vulnerability does not appear in the CISA KEV catalog, so active exploitation cannot be confirmed. No public POC code has been identified at time of analysis. VulnCheck's reporting and the vendor's own GHSA advisory agree on the severity, and the existence of two fixed branches (2.31.5 and 2.32.1) suggests this affected code persisted across a patch cycle. The absence of KEV listing and POC should not induce complacency given the straightforward exploitation conditions for any user with workflow access.

An attacker with a low-privilege n8n account that includes workflow creation or editing rights composes a workflow node containing a JavaScript expression that uses an arrow-function body to escape the expression sandbox and invoke a Node.js child process spawner. When the workflow executes - either manually or on a trigger - n8n evaluates the expression, and the sandboxed boundary is bypassed, running arbitrary OS commands under the n8n server process identity, potentially enabling data exfiltration, reverse shell establishment, or lateral movement to other services co-located on the host.