EUVD-2026-70404
GHSA-733v-xpr6-gwgq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Sandbox escape into host Node.js process warrants S:C; PR:L reflects required workflow-build authentication; all CIA are H given arbitrary process-level code execution.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain an expression sandbox escape in the $fromAI handler. $fromAI resolved a caller-supplied placeholder name without requiring it to be an own property and admitted reserved keys; against a primitive input value it returned a live host-prototype reference. An attacker with workflow-build privilege can walk the prototype chain to the Function constructor and compile/execute arbitrary code in the main n8n process, leading to remote code execution.
AnalysisAI
Prototype chain sandbox escape in n8n's $fromAI expression handler allows any user holding workflow-build privilege to achieve remote code execution within the main n8n server process. The $fromAI handler failed to restrict placeholder key lookup to own properties and permitted reserved prototype keys; when the input value is a primitive, the handler returns a live reference to the host-prototype chain, enabling traversal to Function.prototype.constructor and compilation of arbitrary JavaScript outside the expression sandbox. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an account with workflow-build privilege in the target n8n instance-this is any user who can create or edit workflows, which is the default capability for non-viewer roles. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 8.7, reflecting a realistic but not trivially mass-exploitable vulnerability: network-accessible, low complexity, but requiring workflow-build privilege (PR:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade n8n to version 1.123.73 or later (v1 track), 2.35.4 or later, or 2.36.2 or later (v2 track) per the vendor advisory at https://github.com/n8n-io/n8n/security/advisories/GHSA-9x83-43r8-5hwc. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an access review to identify and restrict all users with workflow-build privileges to essential personnel only; enable audit logging for all expression evaluations and monitor for suspicious activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
n8n workflow automation (through 1.121.2) allows authenticated users to execute arbitrary code via the n8n service, with
n8n workflow automation (1.65.0 to 1.121.0) allows unauthenticated file access through form-based workflows. A critical
n8n has a fifth critical RCE vulnerability (CVSS 9.9) in the Expression evaluator, enabling code execution through craft
A prototype pollution vulnerability in the XML and GSuiteAdmin nodes of n8n workflow automation platform allows authenti
An authenticated user with workflow creation or modification privileges in n8n workflow automation platform can exploit
n8n-workflows Main Commit ee25413 allows attackers to execute a directory traversal via the download_workflow function w
Authenticated n8n users can hijack administrator accounts when LDAP authentication is enabled by manipulating their LDAP
The n8n package 0.218.0 for Node.js allows Escalation of Privileges. Rated high severity (CVSS 8.8), this vulnerability
SQL injection in n8n's Data Table Get node allows authenticated users with workflow modification permissions to execute
Authenticated users can exploit string formatting and exception handling in n8n's Python task executor to escape sandbox
n8n workflow automation platform Community Edition contains an authorization bypass vulnerability allowing authenticated
The n8n package 0.218.0 for Node.js allows Information Disclosure. Rated high severity (CVSS 7.5), this vulnerability is
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today