Full research report
n8n Sandbox Escape Lets Workflow Editors Run OS Commands as the n8n Process
Executive assessment
GHSA-gv7g-jm28-cr3m is a bypass of n8n's February 2026 CVE-2026-27577 patch, exploiting two independent oversights in the same AST identifier-rewriting layer: ArrowFunctionExpression nodes were silently ignored, and Reflect.get() received property names as function arguments rather than inspectable static expressions. Security Joes noted that neither condition alone was sufficient and neither was covered by the existing test suite, indicating the post-CVE-2026-27577 hardening was narrowly targeted rather than a comprehensive review of the rewriter's handling of all JavaScript expression forms. CVE-2026-50522 in the source material is an unrelated Microsoft SharePoint deserialization vulnerability that was actively exploited in the same news cycle and appeared in the article's sidebar; it does not represent exploitation of the n8n story. No public proof-of-concept for GHSA-gv7g-jm28-cr3m has been released, but the availability of the patched source diff makes the arrow-function gap publicly identifiable to capable researchers. Organisations running n8n with broadly privileged stored credentials or internal service connectivity should treat this as an urgent patch, given that successful exploitation yields command execution as the n8n service account and potential access to the master encryption key.
What happened
Security Joes discovered a high-severity expression sandbox escape (GHSA-gv7g-jm28-cr3m, CVSS 4.0: 8.7) in n8n's workflow automation platform whilst auditing the February 2026 patch for CVE-2026-27577. Researchers identified the residual escape on 14 July 2026, disclosed it through n8n's vulnerability programme on 15 July, and n8n shipped patched releases on 22 July 2026. No CVE had been assigned as of 27 July 2026. CVE-2026-50522, noted in the source material, is a separate and unrelated Microsoft SharePoint deserialization vulnerability that appeared in a sidebar of the source article and does not belong to this n8n story.
Affected scope
n8n versions below 2.31.5 and versions from 2.32.0 up to but not including 2.32.1. Fixed in 2.31.5 and 2.32.1. No patched 1.x release is listed; impact on n8n Cloud is unconfirmed by the advisory. Any authenticated user with workflow creation or modification permission is within the threat model.
Technical assessment
n8n's expression sandbox rewrites JavaScript identifiers in workflow expressions to redirect them away from the live Node.js runtime. In VariablePolyfill.ts, ArrowFunctionExpression nodes were placed in a no-op branch, allowing bare identifiers in concise arrow bodies to resolve against real Node.js globals rather than the sandboxed context. Separately, the sandbox's property checks inspected only static member-expression property names; passing a property name as a function argument to Reflect.get() bypassed that inspection. Combined, these two gaps allowed an authenticated attacker to reach process.getBuiltinModule, load child_process, and execute host commands as the n8n service account. Public source-file comparison confirms the arrow-function gap; independent verification of the complete Reflect.get() exploit chain relies on the Security Joes report as relayed through The Hacker News.
Recommended defensive actions
- Update n8n to version 2.31.5 or 2.32.1 immediately; these are the only confirmed fixed releases.
- Restrict workflow creation and editing permissions to fully trusted users as an interim partial control, noting the vendor characterises this as incomplete short-term mitigation.
- Audit recently created or modified workflows for unexpected arrow functions, Reflect.get() calls, or obfuscated JavaScript.
- Hunt for shell, PowerShell, curl, or wget processes spawned as children of the n8n or Node.js process as indicators of exploitation.
- Rotate the N8N_ENCRYPTION_KEY and all credentials stored in n8n wherever suspicious workflow execution or unexpected host command activity is identified.
Uncertainties and evidence gaps
- No CVE has been assigned to GHSA-gv7g-jm28-cr3m; vulnerability tracking and prioritisation tooling relying on CVE identifiers may not surface this flaw.
- The n8n advisory does not confirm whether n8n Cloud deployments are affected or have already been mitigated by the vendor.
- No patched 1.x release is listed; it is unclear whether the 1.x branch is vulnerable or considered out of scope.
- The complete Reflect.get() exploit chain is described only in Security Joes' privately shared report; the public source-file diff independently confirms only the arrow-function gap.
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
No active exploitation of GHSA-gv7g-jm28-cr3m confirmed; Security Joes observed no exploitation in the wild at time of report preparation and no public proof-of-concept code has been released.
The investigation began by separating the story's two stated CVEs: fetching the GitHub advisory confirmed GHSA-gv7g-jm28-cr3m's scope and patch status, whilst a targeted search and Tenable fetch established that CVE-2026-50522 is a Microsoft SharePoint vulnerability unrelated to n8n and present only in the source article's sidebar. CVE-2026-27577 was then verified as the prior n8n bypass that Security Joes was auditing when they found the new residual escape, and independent CyCognito analysis corroborated that the AST rewriter is a persistent attack surface in n8n's expression sandbox design.
- What is GHSA-gv7g-jm28-cr3m and does it have a CVE?Searched for GHSA-gv7g-jm28-cr3m to locate the primary advisorygithub.com ↗
Vendor GitHub advisory confirmed: CVSS 4.0 score of 8.7 (High), affected versions below 2.31.5 and 2.32.0 to below 2.32.1, fixed in 2.31.5 and 2.32.1, no CVE assigned, no public PoC or exploitation reported. Discoverer credited to researcher 'inaor' at Security Joes.
why The primary vendor advisory is the most authoritative source for scope and patch status, and confirmed the absence of a CVE, which has material implications for how defenders will track this vulnerability.
- Does CVE-2026-50522 relate to this n8n story or is it a different event?Searched for CVE-2026-50522 to identify vendor and producttenable.com ↗
CVE-2026-50522 is a Microsoft SharePoint deserialization vulnerability (CVSS 9.8), added to CISA KEV on 22 July 2026 following a public PoC. It has no connection to n8n and appears only in the sidebar of the source article.
why Establishing this separation is essential; including CVE-2026-50522 in the n8n report would falsely imply confirmed active exploitation of the n8n story.
- What is CVE-2026-27577 and how does it relate to the new bypass?Fetched the GitHub advisory database entry for CVE-2026-27577github.com ↗
CVE-2026-27577 is a critical (CVSS 9.4) expression sandbox escape in n8n's AST rewriter, fixed February 2026 in versions 1.123.22, 2.9.3, and 2.10.1. The PrototypeSanitizer failed to block process via spread operators and variable shadowing; the same identifier-rewriting layer was the attack surface for the new escape.
why Confirms the lineage: GHSA-gv7g-jm28-cr3m is a residual bypass in the rewriter layer hardened for CVE-2026-27577, which explains why Security Joes found it during a patch-verification audit and why the new score is lower.
- What technical detail did Security Joes report and is the timeline credible?Fetched The Hacker News article reporting the Security Joes findingsthehackernews.com ↗
Confirmed discovery 14 July, disclosure 15 July, patched releases 22 July 2026. Two independent bypass conditions: arrow-function no-op branch and Reflect.get() property-argument bypass. Public source-file diff confirms the arrow-function gap; the complete Reflect.get() chain relies on Security Joes' private report. No exploitation in the wild observed at time of report.
why Provides the technical mechanism behind the advisory and identifies the limit of independent verification, directly informing the uncertainty about the complete exploit chain.
- Is there independent technical corroboration of the n8n AST rewriter as a persistent attack surface?Fetched CyCognito's analysis of CVE-2026-27577cycognito.com ↗
Independently describes the AST rewriter bypass in n8n's expression engine and confirms that authenticated workflow-editor access is the required privilege level, corroborating the attack class from a second source domain.
why A second independent domain analysing the same component strengthens the assessment that the AST rewriter is a structurally weak boundary in n8n's sandbox, lending credibility to the finding that partial patches leave residual bypasses.
Research coverage
All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 4 registered sources supplied useful evidence (2 primary, 1 corroborating, 1 contextual and 0 PoC/exploit references). 57 completed sources contained no matched information for this story.
Complete source-by-source audit 68 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| CISA KEVkev | ok1655 records | Primary evidence1 matched items | Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue. |
| The Hacker Newsnews | ok7 records | Primary evidence1 matched items | Published the source report used to frame and date the event. |
| CISA Alertsnews | ok empty0 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| FIRST EPSSepss | ok | Context1 matched items | Added exploitation-probability context; EPSS does not itself prove exploitation. |
| AlienVault OTXdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| BleepingComputernews | ok8 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | ok5307 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco Talosnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok260 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok666 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1005 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| DNSDumpster domain IOC enrichmentresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok2 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok12 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok15 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok17 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft MSRCvendor_advisory | ok1588 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok2 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| MISP Galaxyresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| NVDcve | ok900 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Rapid7news | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Shodanresearch | ok2 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Sigma Rulesresearch | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 7 opened outside the registered collection
Vulnerability & exploitation2
Technical references4
Repository captured from the source article as technical context; not validated as PoC or exploit code.
Repository captured from the source article as technical context; not validated as PoC or exploit code.
Repository captured from the source article as technical context; not validated as PoC or exploit code.
Repository captured from the source article as technical context; not validated as PoC or exploit code.
Vendor & gov advisories2
Primary vendor advisory; confirms affected versions, CVSS 4.0 score of 8.7, no CVE assigned, and patch availability in 2.31.5 and 2.32.1.
Prior critical-severity bypass (CVSS 9.4) patched February 2026; GHSA-gv7g-jm28-cr3m is a residual escape from the same AST rewriter layer.
Analysis & research2
Primary public reporting containing Security Joes' technical findings, full disclosure timeline, and impact assessment.
Independent technical analysis of the prior bypass confirming the same AST rewriter attack surface and required access level.