[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fnULLELuEMGBlGW2PTZChYRT5At0mJlxduD_BcEJaMhg":3},{"article":4,"iocs":50},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":29,"category":30,"article_tags":34},"7be2b9d5-b794-4d51-b754-915ea0067b14","n8n Sandbox Escape Lets Workflow Editors Run OS Commands as the n8n Process","n8n-sandbox-escape-lets-workflow-editors-run-os-commands-as-the-n8n-process-a95dd2","n8n has patched a high-severity expression-sandbox escape that could let an authenticated workflow editor execute operating-system commands on the server running the automation platform. Security Joes found the flaw while probing n8n's February fix for CVE-2026-27577 for another bypass. The affected ranges are =2.32.0,\u003C2.32.1. n8n fixed the flaw in versions 2.31.5 and","n8n fixed a high-severity expression-sandbox escape (CVE score 8.7) that could allow authenticated workflow editors to execute arbitrary OS commands on the server as the n8n process. Security Joes discovered the flaw while analyzing n8n's February fix for CVE-2026-27577, finding two gaps: an unhandled arrow-function expression type and improper property checks using Reflect.get(). The vulnerability affects versions 2.32.0 through 2.32.0 and was patched in 2.31.5 and later.","n8n patches high-severity sandbox escape allowing authenticated editors to execute OS commands","n8n Sandbox Escape Lets Workflow Editors Run OS Commands as the n8n Process Swati KhandelwalJul 27, 2026Vulnerability \u002F Enterprise Security n8n has patched a high-severity expression-sandbox escape that could let an authenticated workflow editor execute operating-system commands on the server running the automation platform. Security Joes found the flaw while probing n8n's February fix for CVE-2026-27577 for another bypass. The affected ranges are \u003C2.31.5 and >=2.32.0,\u003C2.32.1. n8n fixed the flaw in versions 2.31.5 and 2.32.1. It tracks the issue as GHSA-gv7g-jm28-cr3m, rates it High with a CVSS 4.0 score of 8.7, and no CVE had been assigned as of July 27, 2026. Administrators should update rather than rely on n8n's interim guidance to restrict instance access and workflow editing to fully trusted users. The advisory describes those controls as incomplete, short-term mitigations. It lists no patched 1.x release and does not say whether n8n Cloud was affected. Exploitation requires a valid account with permission to create or modify workflows. It does not require action from another user. A successful exploit executes commands with the privileges of the n8n process. Security Joes, in a report shared with The Hacker News, said that access could expose N8N_ENCRYPTION_KEY and allow decryption of credentials stored in n8n. It could also open paths to connected databases, internal services, and cloud endpoints. The firm had not observed exploitation in the wild when its report was prepared. The public advisory does not say whether the flaw was exploited before the fix. n8n workflow builders use expressions such as ={{ $json.email }}. An abstract syntax tree rewriter redirects free JavaScript identifiers in those expressions to n8n's controlled data context rather than the Node.js runtime. In version 2.31.4, VariablePolyfill.ts placed ArrowFunctionExpression in an explicit no-op branch. A concise arrow body such as () => process could therefore resolve process to the real Node.js global instead of the sandboxed value. The second blind spot, Security Joes said, was in n8n's property checks, which inspect static property names in member expressions. Reflect.get() receives the requested property as a function argument. The researchers used that distinction to recover process.getBuiltinModule, load child_process, and run a command on the host. They tested the proof-of-concept against n8n 2.30.4 through both the released workflow package and a local n8n instance. A comparison of the public 2.31.4 and 2.31.5 source files confirms the arrow-function gap. It does not independently confirm the complete Reflect.get() exploit chain described in Security Joes' report. The fixed rewriter adds a dedicated ArrowFunctionExpression handler that routes a bare identifier in a concise arrow body through the data context. \"Neither alone is sufficient. Neither was covered by tests,\" Security Joes' research team said of the two conditions its exploit relied on. Security Joes initially estimated the flaw would land near the 9.4 Critical rating of CVE-2026-27577; the vendor's published 8.7 is the current score. Researchers identified the residual escape on July 14 and reported it through n8n's vulnerability disclosure program on July 15. n8n published the fixed releases on July 22. Defenders should review recently created or modified workflows for unexpected arrow functions or obfuscated JavaScript. They should also hunt for shells, PowerShell, curl, or wget spawned as children of the n8n or Node.js process. Credentials should be rotated where suspicious workflow execution or host command activity is found. The finding extends a series of expression-sandbox escapes n8n has patched since 2025. It follows CVE-2026-27577, a 9.4-rated escape fixed in February after researchers found the process object slipped through the same identifier-rewriting layer untransformed. In affected deployments where n8n stores broadly privileged credentials or can reach sensitive internal systems, an attacker who compromises a workflow-edit account can use the flaw to execute commands as the n8n process and reach services accessible from the n8n host. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  Application Security, Credential Security, DevOps, enterprise security, remote code execution, Sandbox Escape, Software Security, Vulnerability ⚡ Top Stories This Week New Bit2Watt Attack Could Let Cloud Tenants Disrupt Power Grids Without an Exploit Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents OpenAI Says Its AI Models Escaped Sandbox, Targeted Hugging Face to Cheat Benchmark Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable ⭐ Featured Resources Identity Fraud Is Changing Fast. See the Attacks Businesses Face in 2026 What 25 Million Alerts Reveal About the Threats SOCs Ignore How to Find and Control Every Script Running Through Your Marketing Stack Modern SASE Guide: Close the Gaps Traditional Network Security Cannot See","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fn8n-sandbox-escape-lets-workflow.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjeKRvflcncQ0UoJ9jitnqLM9fezomqM-liKMmU5fccI5_lOaWwgmRYtpHiYQinkYD1fRUCH-wksW6bq8rWMMbKj3cdvaQ-GhA_CcUvcxCnZuzdkadQkIjZUUkVXawqqUZyYkvKO4Rg7IAmCNTBB6Ivu6yKYhBEegL68JmRFb9HimU1CKg2QyQByo8a0MQ\u002Fs1600\u002Fsandbox-flaw-n8n.jpg","2026-07-27T13:05:15+00:00","2026-07-27T14:00:17.030583+00:00",9,[18,21,23,26],{"name":19,"type":20},"n8n","product",{"name":19,"type":22},"vendor",{"name":24,"type":25},"Node.js","technology",{"name":27,"type":28},"Security Joes","threat_actor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":29,"icon":31,"name":32,"slug":33},null,"Vulnerabilities","vulnerabilities",[35,40,45],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":41},{"id":42,"icon":31,"name":43,"slug":44},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":46},{"id":47,"icon":31,"name":48,"slug":49},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",[51],{"type":52,"value":53,"context":54},"cve","CVE-2026-27577","Related prior sandbox escape in n8n fixed in February 2026, rated 9.4 Critical"]