CVE-2026-77077
Received Received - Intake

JavaScript Sandbox Escape in n8n

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: VulnCheck

Description
n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis functions but not internal module constructors such as EventEmitter, allowing an authenticated user with Code node access to exploit prototype pollution to execute arbitrary commands within the runner container. Because the polluted prototype is a process-wide object, the corruption persists across other tenants' Code node executions on the same shared runner. On v1.x instances without task runners enabled, Code node JavaScript runs directly in the main n8n process, where the impact could be higher.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-77077
EUVD
EUVD-2026-63266

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
n8n n8n to 2.33.4 (exc)
n8n n8n to 2.34.1 (exc)
n8n n8n to 1.123.69 (exc)
n8n n8n 2.33.4
n8n n8n 2.34.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Remote Code Execution (RCE) vulnerability in n8n versions before 1.123.69, 2.33.4, and 2.34.1. It occurs due to prototype pollution in the EventEmitter object within the JavaScript Task Runner. The runner's prototype-freezing routine fails to cover internal module constructors like EventEmitter, allowing authenticated users with Code node access to execute arbitrary commands in the runner container.

Detection Guidance

Check n8n version with: n8n --version. If running versions before 1.123.69, 2.33.4, or 2.34.1, the system is vulnerable. Inspect logs for unusual Code node executions or commands. Monitor for prototype pollution attempts in JavaScript task runners.

Impact Analysis

An attacker with Code node access could execute arbitrary commands within the runner container. The polluted prototype persists across other tenants' executions on shared runners. On v1.x without task runners, the impact could be higher as JavaScript runs directly in the main n8n process.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA due to unauthorized code execution and data access risks. The RCE flaw allows attackers to run arbitrary commands within the runner container, which may lead to unauthorized data access, modification, or exfiltration. GDPR requires protecting personal data, and HIPAA mandates safeguarding protected health information. The persistence of the prototype pollution across tenants on shared runners exacerbates these risks by enabling cross-tenant data exposure.

Mitigation Strategies

Upgrade n8n to versions 1.123.69, 2.33.4, or 2.34.1 immediately. Restrict access to the Code node for untrusted users. Disable task runners if not needed. Run JavaScript task runners in isolated processes to limit impact.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77077. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart