Sign in
Deutsch English Español Polski
Medium

n8n: Prototype Pollution via VM Expression Engine Sandbox Escape Leads to Denial of Service

  • Disclosed: 22.07.2026
  • Updated: 11.10.2026 10:22

Impact

An authenticated user able to create or edit a workflow expression could abuse the expression engine's array-element access to obtain a reference to a host built-in and pollute its prototype in the main n8n process, leading to a denial of service.

Both self-hosted and cloud instances running the VM expression engine are affected.

Patches

The issue has been fixed in n8n versions 1.123.67, 2.31.5, and 2.32.1. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

  • Restrict n8n instance access to fully trusted users only.
  • Disable the VM expression engine if an alternative is available for your deployment.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package n8n < 1.123.67, >= 2.32.0, < 2.32.1, >= 2.0.0-rc.0, < 2.31.5 1.123.67, 2.32.1, 2.31.5

References

CVSS score -
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness (CWE)
CWE-1321
Platform
npm
Package
n8n
Disclosed
22.07.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-hx4h-vr3m-45vh - CC BY 4.0

Vulnerability history: n8n

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (156) in the archive
Total entries
156
First → latest
05.2023 09.2026
Without a fix
1
Exploited in attacks
1

Severity breakdown

  • Critical 24
  • High 58
  • Medium 74

Disclosures per year

Severity:
  1. n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Execution
    High CVE-2026-86083 < 1.123.76, >= 2.38.0, < 2.38.2, >= 2.0.0, < 2.37.7 1.123.76, 2.38.2, 2.37.7
  2. n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node
    High CVE-2026-86082 < 1.123.76, >= 2.38.0, < 2.38.2, >= 2.0.0, < 2.37.7 1.123.76, 2.38.2, 2.37.7
  3. n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path
    High CVE-2026-86081 < 1.123.76, >= 2.38.0, < 2.38.2, >= 2.0.0, < 2.37.7 1.123.76, 2.38.2, 2.37.7
  4. n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint
    High CVE-2026-86075 >= 2.38.0, < 2.38.2, < 2.37.7 2.38.2, 2.37.7
  5. n8n: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code Execution
    High CVE-2026-86076 < 1.123.76, >= 2.38.0, < 2.38.2, >= 2.0.0, < 2.37.7 1.123.76, 2.38.2, 2.37.7
  6. n8n: Prototype Pollution via VM Expression Engine Sandbox Escape Leads to Denial of Service this entry
    Medium CVE-2026-72769 < 1.123.67, >= 2.32.0, < 2.32.1, >= 2.0.0-rc.0, < 2.31.5 1.123.67, 2.32.1, 2.31.5
  7. n8n: Prototype Pollution via Dot-Notation Field Names Leads To Instance-Wide Denial of Service
    High CVE-2026-72749 < 1.123.67, >= 2.32.0, < 2.32.1, >= 2.0.0-rc.0, < 2.31.5 1.123.67, 2.32.1, 2.31.5
  8. n8n: Edit Image Node Format Injection Allows Arbitrary File Write
    High CVE-2026-72762 < 1.123.67, >= 2.32.0, < 2.32.1, >= 2.0.0-rc.0, < 2.31.5 1.123.67, 2.32.1, 2.31.5
  9. n8n: Shared-Workflow Editor Can Exfiltrate Credentials via Inline Sub-Workflow JSON
    High CVE-2026-72763 < 1.123.67, >= 2.32.0, < 2.32.1, >= 2.0.0-rc.0, < 2.31.5 1.123.67, 2.32.1, 2.31.5
  10. n8n: Credential Authorization Bypass via Expression in HTTP Request Node `genericAuthType`
    High CVE-2026-72774 < 1.123.67, >= 2.32.0, < 2.32.1, >= 2.0.0-rc.0, < 2.31.5 1.123.67, 2.32.1, 2.31.5
  11. n8n: Expression sandbox escape via arrow-function bodies enabling command execution
    High CVE-2026-72765 >= 2.32.0, < 2.32.1, < 2.31.5 2.32.1, 2.31.5
  12. n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion
    High CVE-2026-72766 < 1.123.67, >= 2.32.0, < 2.32.1, >= 2.0.0-rc.0, < 2.31.5 1.123.67, 2.32.1, 2.31.5
  13. n8n: Authenticated code execution in the n8n Git node
    High CVE-2026-72767 < 1.123.67, >= 2.32.0, < 2.32.1, >= 2.0.0-rc.0, < 2.31.5 1.123.67, 2.32.1, 2.31.5
  14. n8n: Git Node fetch/pull/pushTags Operations Bypass Sandbox Path Restriction
    High CVE-2026-72770 < 1.123.67, >= 2.32.0, < 2.32.1, >= 2.0.0-rc.0, < 2.31.5 1.123.67, 2.32.1, 2.31.5
  15. n8n: Bypass "Allowed HTTP Request Domains" Credential Restriction in Multiple AI and LLM Nodes
    High CVE-2026-72771 >= 2.32.0, < 2.32.1, < 2.31.5 2.32.1, 2.31.5
  16. n8n: Account Takeover via Unverified Email Claim in Token Exchange Embed Login
    High CVE-2026-72772 >= 2.32.0, < 2.32.1, < 2.31.5 2.32.1, 2.31.5
  17. n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner
    High CVE-2026-65016 < 1.123.64, >= 2.30.0, < 2.30.1, >= 2.0.0-rc.0, < 2.29.8 1.123.64, 2.30.1, 2.29.8
  18. n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution
    High CVE-2026-65591 < 1.123.64, >= 2.30.0, < 2.30.1, >= 2.0.0-rc.0, < 2.29.8 1.123.64, 2.30.1, 2.29.8
  19. n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs
    High CVE-2026-65595 >= 2.30.0, < 2.30.1, < 2.29.8 2.30.1, 2.29.8
  20. n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution
    High CVE-2026-59208 >= 2.28.0, < 2.28.1, < 2.27.4 2.28.1, 2.27.4
  21. n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector
    High CVE-2026-59207 >= 2.28.0, < 2.28.1, < 2.27.4 2.28.1, 2.27.4
  22. n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration
    High CVE-2026-59206 < 1.123.61, >= 2.28.0, < 2.28.1, >= 2.0.0-rc.0, < 2.27.4 1.123.61, 2.28.1, 2.27.4
  23. n8n: Shared Credential Header Leak via HTTP Request Pagination Expression
    High CVE-2026-59209 < 1.123.61, >= 2.28.0, < 2.28.1, >= 2.0.0-rc.0, < 2.27.4 1.123.61, 2.28.1, 2.27.4
  24. n8n: Stored DOM XSS via Resource Locator `cachedResultUrl`
    High CVE-2026-65592 < 1.123.64, >= 2.30.0, < 2.30.1, >= 2.0.0-rc.0, < 2.29.8 1.123.64, 2.30.1, 2.29.8
  25. n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview
    High CVE-2026-65597 < 1.123.64, >= 2.30.0, < 2.30.1, >= 2.0.0-rc.0, < 2.29.8 1.123.64, 2.30.1, 2.29.8
  26. n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution
    High CVE-2026-65598 < 1.123.64, >= 2.30.0, < 2.30.1, >= 2.0.0-rc.0, < 2.29.8 1.123.64, 2.30.1, 2.29.8
  27. n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool
    High CVE-2026-65015 >= 2.30.0, < 2.30.1, < 2.29.8 2.30.1, 2.29.8
  28. n8n: SecurityScorecard Node Leaks API Token to User-Controlled Host
    High · 7.7 CVE-2026-54304 < 1.123.55, >= 2.26.0, < 2.26.1, >= 2.0.0-rc.0, < 2.25.7 1.123.55, 2.26.1, 2.25.7
  29. n8n: MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions
    High · 10.0 CVE-2026-54309 >= 2.26.0, < 2.26.2, < 2.25.7 2.26.2, 2.25.7
  30. n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints
    High · 9.9 CVE-2026-54305 < 1.123.55, >= 2.26.0, < 2.26.2, >= 2.0.0-rc.0, < 2.25.7 1.123.55, 2.26.2, 2.25.7
  31. n8n: Credential Exfiltration via Permission Bypass
    High · 9.6 CVE-2026-54307 < 1.123.55, >= 2.26.0, < 2.26.2, >= 2.0.0-rc.0, < 2.25.7 1.123.55, 2.26.2, 2.25.7
  32. n8n: Stored XSS in Chat Trigger Node
    High · 7.6 CVE-2026-54302 < 1.123.55, >= 2.26.0, < 2.26.2, >= 2.0.0-rc.0, < 2.25.7 1.123.55, 2.26.2, 2.25.7
  33. n8n: Microsoft SQL Node Prototype Pollution
    High · 8.5 CVE-2026-54312 < 2.24.0 2.24.0
  34. n8n: Same-Origin XSS in Respond to Webhook Node
    High · 7.6 CVE-2026-54301 < 1.123.55, >= 2.26.0, < 2.26.2, >= 2.0.0-rc.0, < 2.25.7 1.123.55, 2.26.2, 2.25.7
  35. n8n: Python sandbox escape
    High · 8.5 CVE-2026-49444 < 1.123.48, >= 2.22.0, < 2.22.4, >= 2.0.0-rc.0, < 2.21.8 1.123.48, 2.22.4, 2.21.8
  36. n8n Has a Cross-user Authorization Bypass in Dynamic Credential OAuth Endpoints
    High · 8.1 CVE-2026-45732 < 1.123.43, >= 2.21.0, < 2.21.1, >= 2.0.0-rc.0, < 2.20.7 1.123.43, 2.21.1, 2.20.7
  37. n8n Has a Source Control Pull SQL Injection
    High · 9.0 CVE-2026-44792 < 1.123.43, >= 2.21.0, < 2.21.1, >= 2.0.0-rc.0, < 2.20.7 1.123.43, 2.21.1, 2.20.7
  38. n8n Has an XML Node Prototype Pollution Patch Bypass
    Critical · 9.9 CVE-2026-44791 < 1.123.43, >= 2.21.0, < 2.22.1, >= 2.0.0-rc.0, < 2.20.7 1.123.43, 2.22.1, 2.20.7
  39. n8n Has an Arbitrary File Read via Git Node
    Critical · 8.8 CVE-2026-44790 < 1.123.43, >= 2.21.0, < 2.22.1, >= 2.0.0-rc.0, < 2.20.7 1.123.43, 2.22.1, 2.20.7
  40. n8n: HTTP Request Node Pagination Prototype Pollution to RCE
    Critical · 9.9 CVE-2026-44789 < 1.123.43, >= 2.21.0, < 2.22.1, >= 2.0.0-rc.0, < 2.20.7 1.123.43, 2.22.1, 2.20.7
Show more (20) Showing 40 of 83

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.