n8n Patches High-Severity Sandbox Escape Allowing OS Command Execution

n8n has released patches for a high-severity sandbox escape vulnerability that enables authenticated workflow editors to execute operating system commands on servers running the popular automation platform. The flaw, tracked as GHSA-gv7g-jm28-cr3m with a CVSS 4.0 score of 8.7, was discovered by Security Joes researchers while probing the February fix for CVE-2026-27577 for a viable bypass. Affected versions include all n8n releases below 2.31.5, as well as versions 2.32.0 up to but not including 2.32.1. Administrators should upgrade to n8n 2.31.5 or 2.32.1 immediately rather than relying on n8n's interim guidance to restrict workflow editing to fully trusted users, which the vendor describes as incomplete short-term mitigation.

The exploit chain combines two blind spots in n8n's expression sandbox, which uses an abstract syntax tree rewriter to redirect free JavaScript identifiers in workflow expressions such as ={{ $json.email }} to a controlled data context rather than the Node.js runtime. In version 2.31.4, the file VariablePolyfill.ts placed ArrowFunctionExpression in an explicit no-op branch, meaning a concise arrow body like () => process would resolve process to the real Node.js global instead of the sandboxed value. The second weakness involved n8n's property checks, which inspect static property names in member expressions; the researchers exploited the distinction with Reflect.get() to recover process.getBuiltinModule, load child_process, and execute commands on the host. Security Joes confirmed the proof-of-concept against n8n 2.30.4 through both the released workflow package and a local instance, and noted that neither condition alone was sufficient for exploitation, with neither path covered by existing tests.

A successful exploit would run commands with the privileges of the n8n process, potentially exposing the N8N_ENCRYPTION_KEY and enabling decryption of stored credentials. From there, attackers could pivot to connected databases, internal services, and cloud endpoints. Security Joes had not observed exploitation in the wild when its report was prepared, though the public advisory does not confirm whether the flaw was weaponized before the patch. Organizations running n8n should patch without delay, use a password checker to audit any credentials that may have been stored in affected instances, and run an email breach checker to confirm that user accounts have not been compromised. For broader environment hardening, security teams can perform a privacy checkup to identify any additional exposure across connected systems.