n8n EUVD-2026-63271

Exploitation requires an authenticated account with permissions to create and execute n8n workflows containing JavaScript Code nodes - this is a low-privilege but non-anonymous condition (PR:L in CVSS 4.0). The initial sandbox escape (Function.prototype pollution to recover host globalThis) is achievable once Code node execution is possible, but meaningful post-escape impact additionally depends on specific Node.js modules (e.g., child_process, fs, net) being present in the deployment's configured import allowlist, which is a non-default administrator-controlled setting. Deployments with an empty or minimal allowlist limit the attacker's ability to complete the full chain beyond information disclosure. Exploitation is limited to authenticated users; unauthenticated remote attackers cannot reach the Code node execution path. The attack is network-delivered but not remotely exploitable against a locked-down, no-Code-node-access deployment.

The CVSS 4.0 base score of 6.0 accurately reflects a nuanced risk profile. The CVSS vector (AV:N/AC:H/AT:P/PR:L/UI:N) indicates network-reachable exploitation requires low-level authenticated access (workflow authors), high complexity, and specific preconditions - most critically, the full exploit chain depends on particular Node.js modules being present in the deployment's import allowlist. EPSS data is not available in the provided intelligence, so exploitation probability cannot be quantitatively assessed. The vulnerability is not in CISA KEV, and no POC code is confirmed. Despite the high confidentiality impact (VC:H) from host globalThis access, the practical risk is substantially shaped by how tightly administrators have restricted the Code node import allowlist. Deployments where Code node execution is limited to trusted internal developers face considerably lower risk than multi-tenant n8n environments where untrusted users have workflow creation rights. The tags 'Information Disclosure' and 'Prototype Pollution' align with the CVSS C:H/I:L profile. The integrity impact is assessed as low because direct arbitrary write to the host is limited without further module-dependent steps. No conflicting signals between CVSS and description were identified.

An authenticated n8n user with workflow authoring rights creates a Code node containing JavaScript that modifies Function.prototype within the VM sandbox context. Because the sandbox does not freeze this prototype, the modification persists and provides a path to reference the host Node.js process's globalThis object, escaping the sandbox isolation boundary. If the deployment's import allowlist includes modules such as child_process or fs, the attacker can then leverage those to read sensitive data from the host filesystem or execute operating system commands. No confirmed public POC exists at time of analysis, but the technique is well-understood in the Node.js VM escape research community.