n8n CVE-2026-85165

Exploitation requires a valid n8n account with workflow-edit permission (create or modify workflows). This is a non-default privilege in hardened deployments but commonly granted in collaborative or shared n8n instances. The attacker must craft expressions using one of the specific JavaScript syntax positions that bypass sandbox identifier resolution: SpreadElement, computed property key, switch-case expression, or class heritage/extension clause. No additional prerequisites are documented. Exploitation is limited to n8n versions before 2.36.2. What limits exploitation in practice: (1) authentication and workflow-edit permission gate access; (2) mutations are process-wide but do not directly write to the filesystem or exfiltrate data without further chaining; (3) a service restart clears mutated state. On single-user self-hosted instances, the attack surface is minimal, but the impact is severe on multi-user instances where cross-user process contamination is the primary risk.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H) reflects a network-reachable, low-complexity attack requiring low privileges - specifically, a valid account with workflow-edit permission. Real-world risk is moderated by the authentication requirement: this is not a zero-interaction pre-auth flaw, and exploitation is limited to users who have been granted workflow creation or editing rights. In multi-tenant n8n SaaS deployments or shared enterprise instances, this boundary is the critical control to assess. The integrity and availability impacts are rated High because process-wide host-object mutation can corrupt shared state for all workflows on the instance, potentially enabling prototype pollution or environment variable tampering that cascades into other users' workflow executions. No EPSS score was provided, no KEV listing exists, and no public POC has been identified, suggesting limited opportunistic exploitation to date. However, the persistent, cross-tenant impact makes this a meaningful insider or supply-chain-adjacent risk in multi-user deployments.

An authenticated n8n user with workflow-edit rights creates a workflow containing a crafted expression that uses a computed property key or spread element to reference a process global such as process.env or Object.prototype. The sandbox fails to intercept the identifier resolution, and the attacker's code mutates a shared host object - for example, poisoning Object.prototype with a malicious property. The change persists across all n8n workflow executions on the same process, potentially affecting other users' data or enabling secondary privilege escalation through polluted object behavior. No public POC has been identified, but the vulnerability class (sandbox escape via AST node type omission) is well-understood and reproducible from the description.