CVE-2026-72765: n8n Sandbox Escape RCE Vulnerability

CVE-2026-72765 Overview

CVE-2026-72765 is a sandbox escape vulnerability in n8n, an open-source workflow automation platform. The flaw exists in the expression evaluation engine used by workflow nodes. Authenticated users with permission to create or modify workflows can craft expressions using arrow-function bodies to bypass the sandbox. Successful exploitation triggers system command execution on the host running n8n. The vulnerability affects n8n versions prior to 2.31.5 and prior to 2.32.1. The issue is classified as [CWE-94] Improper Control of Generation of Code. It is tracked by GitHub Security Advisory GHSA-gv7g-jm28-cr3m and a VulnCheck Remote Code Execution Advisory.

Critical Impact
Authenticated workflow authors can escape the expression sandbox and execute arbitrary operating system commands on the n8n host, leading to full server compromise.

Affected Products

n8n versions prior to 2.31.5
n8n versions prior to 2.32.1
Self-hosted n8n deployments exposing workflow authoring to multiple users

Discovery Timeline

2026-08-11 - CVE-2026-72765 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72765

Vulnerability Analysis

n8n allows users to embed JavaScript expressions inside workflow node parameters. These expressions are evaluated in a restricted sandbox intended to block access to Node.js internals such as process, require, and child_process. The sandbox scans expression syntax to reject dangerous constructs before evaluation.

The sandbox fails to properly inspect the bodies of arrow functions. When an attacker embeds malicious code inside an arrow-function body, the analyzer does not traverse into the function scope with the same restrictions applied to the outer expression. When the workflow executes and the arrow function is invoked, the payload runs in the underlying Node.js runtime with the privileges of the n8n process.

Because n8n often runs with access to credentials, database connections, and cloud API tokens, code execution on the host frequently leads to lateral movement across integrated systems.

Root Cause

The root cause is incomplete sandbox validation of nested code constructs. Arrow-function bodies are treated as opaque data rather than executable code requiring the same restriction pass as the top-level expression. This gap allows attackers to reintroduce forbidden identifiers and reach Node.js runtime primitives.

Attack Vector

Exploitation requires an authenticated account with permission to create or edit workflows. The attacker crafts an expression containing an arrow function whose body references restricted globals or requires modules such as child_process. When the workflow runs, either manually or on a schedule, the arrow function is evaluated and the payload executes system commands on the n8n host. No user interaction beyond triggering the workflow is required. Refer to the VulnCheck advisory for technical details.

Detection Methods for CVE-2026-72765

Indicators of Compromise

Unexpected child processes spawned by the n8n Node.js process, such as /bin/sh, bash, cmd.exe, or powershell.exe.
Outbound network connections initiated by the n8n process to unfamiliar hosts shortly after workflow execution.
Workflow definitions containing arrow-function expressions that reference constructor, require, process, or global.
New or modified workflows created by low-privilege users immediately before anomalous host activity.

Detection Strategies

Audit workflow JSON exports for expressions containing => combined with references to process, require, or child_process.
Enable and review n8n audit logs for workflow create and update events performed by non-administrative accounts.
Correlate workflow execution timestamps with process creation and outbound connection events on the n8n host.

Monitoring Recommendations

Monitor the n8n service account for process creation events that fall outside expected Node.js child processes.
Alert on n8n making outbound connections to non-integration endpoints or raw IP addresses.
Track version strings reported by n8n instances to identify unpatched deployments across the estate.

How to Mitigate CVE-2026-72765

Immediate Actions Required

Upgrade n8n to version 2.31.5 or 2.32.1, matching the maintenance branch in use.
Review all existing workflows for arrow-function expressions and remove any that reference Node.js internals.
Rotate credentials, API tokens, and database secrets stored in n8n if unauthorized workflow edits are suspected.
Restrict workflow creation and modification permissions to trusted operators.

Patch Information

The issue is fixed in n8n 2.31.5 and 2.32.1. Details are published in GitHub Security Advisory GHSA-gv7g-jm28-cr3m. Operators running self-hosted deployments should update container images, Helm charts, or npm packages and restart the n8n service. n8n Cloud instances are patched by the vendor.

Workarounds

Remove the workflow create and edit role from any account that does not require it until patches are deployed.
Place the n8n instance behind network segmentation that restricts outbound egress from the host.
Run the n8n process as a dedicated low-privilege user without access to sensitive host resources.
Enable audit logging and review workflow changes daily until upgrades are complete.

bash

# Upgrade self-hosted n8n via npm
npm install -g n8n@2.32.1

# Or update the Docker image tag and redeploy
docker pull n8nio/n8n:2.32.1
docker stop n8n && docker rm n8n
docker run -d --name n8n -p 5678:5678 n8nio/n8n:2.32.1