CVE-2026-86076 Overview
CVE-2026-86076 is a code injection vulnerability [CWE-94] in n8n, an open-source workflow automation platform. The flaw resides in the expression compiler sanitizer, which resolved through a dynamically scoped this and failed to reject reserved class member names. An attacker who can define a class field named __sanitize can rebind the sanitizer and reach the JavaScript Function constructor. This bypass enables backend code execution on the n8n server and JavaScript execution in the editor preview. The vulnerability affects n8n versions prior to 1.123.76, 2.37.7, and 2.38.2.
Critical Impact
Authenticated attackers can achieve arbitrary code execution on the n8n backend and inject JavaScript into editor previews, compromising workflow integrity and host systems.
Affected Products
- n8n versions prior to 1.123.76
- n8n versions prior to 2.37.7
- n8n versions prior to 2.38.2
Discovery Timeline
- 2026-09-08 - CVE-2026-86076 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-86076
Vulnerability Analysis
n8n evaluates user-authored expressions through a compiler that applies a sanitizer to block dangerous prototype access. The sanitizer logic lives in the PrototypeSanitizer AST hook within packages/workflow/src/expression-sandboxing.ts. The sanitizer relied on a dynamically scoped this reference and did not enforce a deny-list of reserved class member names. This design allowed attacker-controlled class fields to shadow the sanitizer function itself.
Once the sanitizer is rebound, the compiler no longer blocks access to sensitive globals. The attacker can then traverse to JavaScript's Function constructor and execute arbitrary code inside the Node.js runtime that hosts workflow execution.
Root Cause
The root cause is improper control of code generation [CWE-94] in the expression sandbox. The PrototypeSanitizer hook trusted dynamically scoped identifiers and did not reject reserved names such as __sanitize. A class definition inside an evaluated expression can therefore introduce a field that overrides the sanitizer at runtime, defeating the security boundary before dangerous property access is inspected.
Attack Vector
An authenticated user with the ability to author or edit workflow expressions crafts an expression that declares a class with a __sanitize field. When the expression compiler processes the input, the malicious field rebinds the sanitizer during evaluation. The payload then reaches the Function constructor, achieving backend code execution. The same class field also triggers JavaScript execution inside the editor preview, exposing other users of the n8n editor to script injection. Refer to the GitHub Security Advisory GHSA-hw8v-xxg5-vvvx for technical details.
Detection Methods for CVE-2026-86076
Indicators of Compromise
- Workflow expressions or JSON definitions containing the literal token __sanitize as a class field, property, or method name.
- Unexpected outbound network connections from the n8n Node.js process to attacker-controlled infrastructure.
- New or modified workflows created by low-privilege users shortly before anomalous process activity on the n8n host.
Detection Strategies
- Inspect the workflow database and audit logs for expressions containing class declarations combined with the reserved identifier __sanitize.
- Monitor the n8n process for child processes such as sh, bash, node, or curl spawned during workflow execution windows.
- Correlate authenticated editor sessions against runtime anomalies to identify accounts abusing expression evaluation.
Monitoring Recommendations
- Enable verbose n8n audit logging for workflow create, update, and execute events, and forward logs to a centralized analytics platform.
- Alert on file system writes and outbound connections originating from the n8n runtime user account.
- Track version identifiers across n8n deployments to confirm patched builds are in production.
How to Mitigate CVE-2026-86076
Immediate Actions Required
- Upgrade n8n to version 1.123.76, 2.37.7, or 2.38.2 as appropriate for your release track.
- Restrict workflow authoring permissions to trusted users and revoke editor access for accounts that do not require it.
- Rotate credentials, API keys, and secrets stored in n8n if unpatched instances were exposed to untrusted users.
Patch Information
The n8n maintainers fixed the vulnerability by hardening the PrototypeSanitizer AST hook in packages/workflow/src/expression-sandboxing.ts to reject reserved class member names and resolve the sanitizer without relying on dynamically scoped this. Patched builds are available in n8n Release v1.123.76, n8n Release v2.37.7, and n8n Release v2.38.2.
Workarounds
- Place n8n behind an authenticated reverse proxy and limit access to a small set of administrators until patching is complete.
- Disable or restrict community and custom node execution to reduce the attack surface exposed to expression evaluation.
- Run n8n as a low-privileged user in an isolated container or virtual machine to contain the impact of any successful exploitation.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
