CVE-2026-72765

EUVD-2026-56144
n8n before 2.31.5 and before 2.32.1 contain a sandbox escape vulnerability in expression evaluation. An authenticated user with permission to create or modify workflows can craft expressions using arrow-function bodies to bypass the expression sandbox, triggering system command execution on the host running n8n. The issue is fixed in versions 2.31.5 and 2.32.1.
Code Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.9 CRITICAL
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 56.81%
Affected Products (NVD)
VendorProductVersion
n8nn8n
2.31.0 ≤
𝑥
< 2.31.5
n8nn8n
2.32.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/n8n-io/n8n/security/advisories/GHSA-gv7g-jm28-cr3m
https://www.vulncheck.com/advisories/n8n-before-remote-code-execution-via-expression-sandbox-escape