CVE-2026-85165

Analyzed Analyzed - Analysis Complete

Expression Sandbox Bypass in n8n Workflows

Publication date: 2026-09-03

Last updated on: 2026-10-29

Assigner: VulnCheck

Description

n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, or class-extension positions resolve against process globals. Authenticated users with workflow-edit permission can mutate host objects through expression evaluation, with changes persisting process-wide until restart.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-03

Last Modified

2026-10-29

Generated

2026-11-08

AI Q&A

2026-09-03

EPSS Evaluated

2026-11-07

NVD

CVE-2026-85165

EUVD

EUVD-2026-70400

Affected Vendors & Products

Vendor	Product	Version / Range
n8n	n8n	to 2.35.4 (exc)
n8n	n8n	From 2.36.0 (inc) to 2.36.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-95	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

Attack-Flow Graph

Executive Summary

n8n versions before 2.36.2 have an expression sandbox bypass vulnerability. Authenticated users with workflow-edit permissions can exploit free identifiers in spread, computed-key, switch-case, or class-extension positions to resolve against process globals. This allows mutation of host objects through expression evaluation, with changes persisting process-wide until a restart.

Detection Guidance

Check n8n version with: n8n --version. If version is below 2.36.2, the system is vulnerable. Monitor for unauthorized workflow edits or unexpected object mutations in logs.

Impact Analysis

Attackers with low privileges can achieve high integrity and availability impacts. Unauthorized modifications to shared objects persist across all subsequent expression evaluations until the n8n process restarts. This may lead to data corruption, system instability, or unintended behavior in workflows.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, which may violate GDPR's data integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Persistent object mutation risks unauthorized exposure or tampering with sensitive data.

Mitigation Strategies

Upgrade n8n to version 2.36.2 or later immediately. Restrict workflow-edit permissions to trusted users only. Restart the n8n process periodically as a temporary measure.

Hi! I’m here to help you understand CVE-2026-85165. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...