n8n Sandbox Escape Lets Workflow Editors Run OS Commands as the n8n Process

Vulnerability / Enterprise Security n8n has patched a high-severity expression-sandbox escape that could let an authenticated workflow editor execute operating-system commands on the server running the automation platform. Security Joes found the flaw while probing n8n's February fix for CVE-2026-27577 for another bypass. The affected ranges are =2.32.0, process could therefore resolve process to the real Node.js global instead of the sandboxed value. The second blind spot, Security Joes said, was in n8n's property checks, which inspect static property names in member expressions. Reflect.get() receives the requested property as a function argument. The researchers used that distinction to recover process.getBuiltinModule, load child_process, and run a command on the host. They tested the proof-of-concept against n8n 2.30.4 through both the released workflow package and a local n8n instance. A comparison of the public 2.31.4 and 2.31.5 source files confirms the arrow-function gap. It does not independently confirm the complete Reflect.get() exploit chain described in Security Joes' report. The fixed rewriter adds a dedicated ArrowFunctionExpression handler that routes a bare identifier in a concise arrow body through the data context. "Neither alone is sufficient. Neither was covered by tests," Security Joes' research team said of the two conditions its exploit relied on. Security Joes initially estimated the flaw would land near the 9.4 Critical rating of CVE-2026-27577; the vendor's published 8.7 is the current score. Researchers identified the residual escape on July 14 and reported it through n8n's vulnerability disclosure program on July 15. n8n published the fixed releases on July 22. Defenders should review recently created or modified workflows for unexpected arrow functions or obfuscated JavaScript. They should also hunt for shells, PowerShell, curl, or wget spawned as children of the n8n or Node.js process. Credentials should be rotated where suspicious workflow execution or host command activity is found. The finding extends a series of expression-sandbox escapes n8n has patched since 2025. It follows CVE-2026-27577, a 9.4-rated escape fixed in February after researchers found the process object slipped through the same identifier-rewriting layer untransformed. In affected deployments where n8n stores broadly privileged credentials or can reach sensitive internal systems, an attacker who compromises a workflow-edit account can use the flaw to execute commands as the n8n process and reach services accessible from the n8n host. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.