CVE-2026-72765
Received Received - Intake

Sandbox Escape via Expression Evaluation in n8n

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: VulnCheck

Description
n8n before 2.31.5 and before 2.32.1 contain a sandbox escape vulnerability in expression evaluation. An authenticated user with permission to create or modify workflows can craft expressions using arrow-function bodies to bypass the expression sandbox, triggering system command execution on the host running n8n. The issue is fixed in versions 2.31.5 and 2.32.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-72765
EUVD
EUVD-2026-56144

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n8n n8n to 2.32.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a sandbox escape vulnerability in n8n versions before 2.31.5 and 2.32.1. An authenticated user with workflow modification permissions can craft expressions using arrow-function bodies to bypass the expression sandbox. This allows system command execution on the host running n8n.

Detection Guidance

Detecting this vulnerability requires checking the installed version of n8n. Compare your version against 2.31.5 and 2.32.1. If your version is older, the system is vulnerable. Use commands like 'n8n --version' or check package managers (e.g., 'npm list n8n' or 'apt list --installed | grep n8n').

Review workflows for suspicious expressions using arrow-function bodies, as these may indicate exploitation attempts.

Impact Analysis

This vulnerability allows attackers to execute arbitrary system commands on the host running n8n. It can lead to full compromise of the system, including data theft, data manipulation, or service disruption. The impact includes high risk to confidentiality, integrity, and availability of the affected system.

Compliance Impact

This vulnerability can lead to unauthorized access and data breaches, which may violate compliance requirements under GDPR, HIPAA, and other regulations. It risks exposing sensitive data, leading to potential legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Immediately upgrade n8n to version 2.31.5, 2.32.1, or later. Restrict instance access and workflow permissions to trusted users only as a temporary measure.

Monitor for unusual system activity or unauthorized command execution, especially in workflows created or modified by users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72765. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart