Full Report
n8n has patched a high-severity expression-sandbox escape that could let an authenticated workflow editor execute operating-system commands on the server running the automation platform. Security Joes found the flaw while probing n8n's February fix for CVE-2026-27577 for another bypass. The affected ranges are =2.32.0,<2.32.1. n8n fixed the flaw in versions 2.31.5 and
Analysis Summary
# Vulnerability: n8n Expression Sandbox Escape via Reflect.get()
## CVE Details
- **CVE ID**: Not explicitly assigned in the text (referenced as a bypass of CVE-2026-27577)
- **CVSS Score**: 8.7 (High)
- **CWE**: CWE-693: Protection Mechanism Failure / CWE-265: Privilege Escalation
## Affected Systems
- **Products**: n8n automation platform
- **Versions**:
- Affected: `2.32.0` and versions prior to `2.31.5` (specifically tested on `2.30.4`)
- Note: Affected ranges include `=2.32.0` and `<2.32.1`.
- **Configurations**: Authenticated users with "Workflow Editor" permissions.
## Vulnerability Description
The flaw is a residual sandbox escape in n8n's expression-rewriting layer. It relies on two primary technical failures in the JavaScript sandbox:
1. **Arrow Function Gap**: The identifier-rewriting layer failed to transform the `process` identifier when used inside the body of a concise arrow function. This allowed the expression to resolve the real Node.js `process` global rather than the sandboxed version.
2. **Reflect.get() Bypass**: n8n’s security checks primarily inspected static property names. By using `Reflect.get()`, researchers passed the requested property as a function argument, bypassing static analysis.
Combining these allowed an attacker to recover `process.getBuiltinModule`, load the `child_process` module, and execute arbitrary operating-system commands.
## Exploitation
- **Status**: PoC available (developed and verified by Security Joes).
- **Complexity**: Medium (Requires understanding of JS sandbox bypasses and n8n expression syntax).
- **Attack Vector**: Network (Authenticated).
## Impact
- **Confidentiality**: High (Access to server files, environment variables, and stored credentials).
- **Integrity**: High (Ability to modify the host system and platform data).
- **Availability**: High (Potential for full server takeover or service disruption).
## Remediation
### Patches
n8n has released the following versions to address the flaw:
- **Version 2.31.5**
- **Version 2.32.1**
The fix involves a rewriter update that adds a dedicated `ArrowFunctionExpression` handler to ensure identifiers are properly routed through the data context.
### Workarounds
- **Restrict Access**: Strictly limit "Workflow Editor" permissions to trusted personnel only.
- **Network Segmentation**: Ensure the n8n host is isolated from sensitive internal networks to limit lateral movement if a compromise occurs.
## Detection
- **Indicators of Compromise (IoCs)**:
- Unexpected or obfuscated JavaScript in workflows.
- Presence of arrow functions (`=>`) in unusual context within n8n expressions.
- Execution of `Reflect.get()` or `process` keywords in workflow logs.
- **Detection Methods**:
- **Process Monitoring**: Audit for child processes like `sh`, `bash`, `powershell.exe`, `curl`, or `wget` spawned directly by the `n8n` or `node` process.
- **Log Review**: Review recently modified workflows for suspicious code patterns.
- **Credential Audit**: If exploitation is suspected, rotate all credentials stored within n8n.
## References
- **Vendor Advisory**: [https://github.com/n8n-io/n8n/security/advisories/GHSA-vpcf-gvg4-6qwr] (Related CVE-2026-27577)
- **Source Code Fix**: [https://github.com/n8n-io/n8n/blob/n8n%402.31.5/packages/%40n8n/tournament/src/VariablePolyfill.ts]
- **News Report**: [https://thehackernews.com/2026/07/n8n-sandbox-escape-lets-workflow.html]