EUVD-2026-63266
GHSA-25g8-cwm4-wqr3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege n8n user
-
DeliveryOpen or create workflow with Code node
-
ExploitSubmit prototype-polluting JavaScript targeting EventEmitter constructor
-
ExecutionEscape VM sandbox freeze boundary
-
PersistExecute arbitrary OS commands in runner container
-
ImpactCorrupt process-wide prototype for subsequent tenant executions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires: (1) a valid n8n account with Code node create/execute permissions - unauthenticated attackers cannot exploit this; (2) the target instance must be running an unpatched version (v1.x before 1.123.69, v2.33.x before 2.33.4, or v2.34.x before 2.34.1); (3) on v2.x, task runners must be enabled (default in v2.x) for the sandboxed runner-escape path; on v1.x instances where task runners are not enabled, Code node JavaScript runs directly in the main n8n process, which raises impact without requiring any runner-specific condition. The cross-tenant pollution component requires the victim tenant to share the same runner process as the attacker - relevant in multi-tenant SaaS or shared self-hosted deployments. Limiting factors: single-tenant self-hosted deployments where all Code node users are trusted eliminate the cross-tenant risk, and Code node access is a non-default permission that must be explicitly granted, reducing exposure in tightly access-controlled environments. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L) scores 7.2 and accurately reflects that exploitation requires a low-privilege authenticated user with Code node access - unauthenticated exploitation is not possible. This credential prerequisite limits exposure compared to fully unauthenticated RCE. However, the cross-tenant prototype-pollution persistence dramatically amplifies real-world impact on any shared or multi-tenant n8n deployment (SaaS, cloud-hosted, or shared self-hosted runners): one compromised or malicious tenant can affect all others. The provided vector's VI:L and SC:N/SI:N/SA:N arguably understates the cross-tenant integrity and subsequent-system impact. EPSS data is absent from the input, so probability-of-exploitation trending cannot be assessed. No CISA KEV listing means active widespread exploitation is not confirmed, but VulnCheck's report and the detailed GitHub Security Advisory suggest researcher-confirmed technical exploitability. The v1.x path (Code node in main process) is higher severity than the v2.x task runner path and should be triaged as critical for any v1.x deployment. For v2.x, the risk is most acute in multi-tenant environments. |
| Exploit ScenarioDerived | An authenticated n8n user with Code node permissions submits a crafted JavaScript payload that targets the unprotected EventEmitter constructor prototype, injecting an executable property that bypasses the VM sandbox's prototype-freeze routine. The polluted prototype persists in the shared Node.js process, causing arbitrary command execution the next time any tenant's Code node instantiates an EventEmitter-derived object - effectively turning the attacker's Code node access into container-level RCE and a cross-tenant attack vector. No public POC has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 20, 2026
Prototype pollution in n8n's JavaScript task runner sandbox allows an authenticated user with Code node access to escape VM isolation and execute arbitrary OS commands within the runner container. Affected versions span the v1.x branch before 1.123.69 and the v2.x branch before 2.33.4 and 2.34.1. The corruption is process-wide, meaning a single malicious execution can poison the prototype chain for all subsequent tenant Code node runs on the same shared runner; on v1.x instances without task runner isolation, the attack surface escalates to the main n8n process itself. No public exploit has been identified at time of analysis and CISA KEV does not list this CVE.
RemediationAI
Upgrade to n8n 1.123.69 (v1.x branch), 2.33.4 (v2.33.x branch), or 2.34.1 (v2.34.x branch) as applicable, per the vendor security advisory GHSA-m3hg-p5r9-fg9h at https://github.com/n8n-io/n8n/security/advisories/GHSA-m3hg-p5r9-fg9h. These are the vendor-confirmed fixed releases stated in the CVE description. Until patching is complete, restrict Code node creation and execution privileges strictly to fully trusted users via n8n's credential and role access controls - removing Code node access from any untrusted or shared-tenant users eliminates the attack surface. In multi-tenant deployments, consider isolating each tenant to a dedicated runner process to prevent cross-tenant prototype pollution even if one tenant is compromised. On v1.x instances, the absence of task runner isolation means Code node access by any user is equivalent to direct main-process access; treat all Code node users on v1.x as fully privileged until the patch is applied.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
n8n (CPE: cpe:2.3:a:n8n-io:n8n) is a Node.js-based workflow automation platform that exposes a Code node allowing workflow authors to execute arbitrary JavaScript. To limit impact, the task runner wraps execution in a VM sandbox and freezes prototypes to prevent escape - however, the freeze routine only covers globalThis-level functions and omits internal Node.js module constructors such as EventEmitter. Because JavaScript prototype chains are process-wide singletons, successfully polluting an unprotected constructor's prototype (CWE-94: Code Injection via prototype pollution) allows the attacker to inject executable properties that are inherited by objects created in any subsequent evaluation context in the same process. On v2.x with task runners enabled, exploitation is bounded to the runner process; on v1.x without task runner isolation, Code node JavaScript executes directly in the main n8n process, removing that containment boundary.
Know when N8n gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
Network-delivered by authenticated low-privilege user; scope changes because process-wide prototype pollution crosses tenant execution boundaries within the shared runner.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis functions but not internal module constructors such as EventEmitter, allowing an authenticated user with Code node access to exploit prototype pollution to execute arbitrary commands within the runner container. Because the polluted prototype is a process-wide object, the corruption persists across other tenants' Code node executions on the same shared runner. On v1.x instances without task runners enabled, Code node JavaScript runs directly in the main n8n process, where the impact could be higher.
Executive ViewAI
Organizations using n8n workflow automation platform (v1.x < 1.123.69, v2.x < 2.33.4 and 2.34.1) face an insider threat risk where authenticated users with Code node access can exploit a prototype pollution vulnerability to execute arbitrary operating system commands on automation infrastructure. Once exploited, the attack persists across all subsequent automation workflows on shared runner systems, creating sustained integrity and confidentiality exposure for business-critical processes dependent on n8n.
Restrict Code node access to system administrators with required business justification; deploy task runners in isolated, ephemeral containers that restart after each workflow execution; implement runtime monitoring to detect and block unexpected system command spawning in runner environments; maintain audit logs of all Code node usage and executed commands; air-gap business-critical workflows from Code node execution by using alternative node types where possible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
n8n workflow automation (through 1.121.2) allows authenticated users to execute arbitrary code via the n8n service, with
n8n workflow automation (1.65.0 to 1.121.0) allows unauthenticated file access through form-based workflows. A critical
n8n has a fifth critical RCE vulnerability (CVSS 9.9) in the Expression evaluator, enabling code execution through craft
Authenticated users who can create or modify an n8n workflow can achieve remote code execution on the n8n host by abusin
A prototype pollution vulnerability in the XML and GSuiteAdmin nodes of n8n workflow automation platform allows authenti
An authenticated user with workflow creation or modification privileges in n8n workflow automation platform can exploit
n8n-workflows Main Commit ee25413 allows attackers to execute a directory traversal via the download_workflow function w
Authenticated n8n users can hijack administrator accounts when LDAP authentication is enabled by manipulating their LDAP
The n8n package 0.218.0 for Node.js allows Escalation of Privileges. Rated high severity (CVSS 8.8), this vulnerability
SQL injection in n8n's Data Table Get node allows authenticated users with workflow modification permissions to execute
Authenticated users can exploit string formatting and exception handling in n8n's Python task executor to escape sandbox
Exploit-DB