n8n has patched a high-severity expression-sandbox escape (GHSA-gv7g-jm28-cr3m, CVSS 4.0: 8.7) that lets authenticated workflow editors run arbitrary operating system commands on the n8n host. The flaw was discovered by Security Joes while probing the February 2026 fix for CVE-2026-27577.
Vulnerability Details
| Property | Value |
|---|---|
| Advisory | GHSA-gv7g-jm28-cr3m |
| CVSS 4.0 Score | 8.7 (High) |
| CVE | Not yet assigned (as of July 27, 2026) |
| Affected Versions | < 2.31.5 and >= 2.32.0, < 2.32.1 |
| Fixed Versions | 2.31.5, 2.32.1 |
| Discovered By | Security Joes |
| Reported | July 15, 2026 |
| Patched | July 22, 2026 |
| Attack Vector | Network (requires authenticated session) |
| Privileges Required | Workflow edit permission |
| User Interaction | None |
Impact Assessment
A successful exploit allows an attacker with workflow-edit permissions to:
- Execute arbitrary OS commands as the n8n process user
- Access the
N8N_ENCRYPTION_KEYand decrypt all stored credentials - Reach connected databases, internal services, and cloud endpoints
- Establish persistence via modified workflows or scheduled executions
- Pivot to other systems accessible from the n8n host
No exploitation in the wild was observed at the time of the advisory. The attack requires a valid account with workflow creation/modification rights — it is not an unauthenticated vulnerability.
Affected Systems
Update immediately if you run:
- n8n self-hosted versions 2.30.x through 2.31.4
- n8n self-hosted versions 2.32.0 (only this specific patch version)
Fixed in:
- n8n 2.31.5 (LTS track)
- n8n 2.32.1 (current track)
No patched 1.x release exists — 1.x users must upgrade to 2.x.
n8n Cloud status: The advisory does not specify whether Cloud was affected. Assume affected until confirmed otherwise by n8n.
Technical Breakdown
n8n's expression language (e.g., ={{ $json.email }}) uses an Abstract Syntax Tree (AST) rewriter to sandbox JavaScript execution. The rewriter replaces free identifiers with lookups into n8n's controlled data context.
Root Cause: Two Independent Gaps in Version 2.31.4
Gap 1: Arrow Function Expression Handling
In VariablePolyfill.ts, ArrowFunctionExpression was placed in an explicit no-op branch. A concise arrow body like () => process could therefore resolve process to the real Node.js global instead of the sandboxed value.
Gap 2: Property Access via Reflect.get()
The rewriter inspects static property names in member expressions. Reflect.get() receives the property name as a runtime argument, bypassing static analysis. Attackers used this to recover process.getBuiltinModule, load child_process, and execute commands.
The Fix (Version 2.31.5)
The patched rewriter adds:
- Dedicated
ArrowFunctionExpressionhandler — routes concise arrow bodies through the data context - Hardened property access checks —
Reflect.get/Reflect.setnow validated against allowed properties
Security Joes noted: "Neither [gap] alone is sufficient. Neither was covered by tests."
Exploitation Requirements
- Valid n8n account (local auth, LDAP, SAML, or OIDC)
- Permission to create or modify workflows (Project Editor or Owner role)
- Network access to n8n web UI
No user interaction required beyond the attacker saving a malicious workflow.
Detection & Mitigation
Immediate Actions
- Upgrade to 2.31.5 or 2.32.1 — this is the only complete fix
- Rotate
N8N_ENCRYPTION_KEYand all stored credentials if suspicious workflows found - Audit recent workflow changes — look for unexpected arrow functions or obfuscated expressions
Workflow Hunting Queries
Search for suspicious expressions in workflow JSON exports:
Host-Based Detection
Monitor for these suspicious child processes of the n8n/Node.js process:
Credential Rotation Checklist
If compromise suspected:
- Rotate
N8N_ENCRYPTION_KEY(requires re-encrypting all credentials) - Rotate all database passwords stored in n8n
- Rotate API keys, OAuth tokens, SSH keys in n8n credentials
- Review cloud provider access (AWS, GCP, Azure keys)
- Check for unauthorized workflow webhooks or triggers
Interim Mitigations (If Upgrade Delayed)
The advisory describes these as incomplete, short-term controls only:
- Restrict n8n access — VPN, zero-trust proxy, or IP allowlist
- Limit workflow editors — remove edit rights from accounts that don't need them
- Enable audit logging — n8n Enterprise audit log captures workflow saves
- Network egress filtering — block unexpected outbound connections from n8n host
Warning from Security Joes: "Those controls are incomplete. An attacker with a single editor account can still exploit the flaw. Upgrade is the only reliable fix."
Comparison: n8n Sandbox Escapes
| CVE / Advisory | Date | CVSS | Type | Fixed In |
|---|---|---|---|---|
| CVE-2026-27577 | Feb 2026 | 9.4 | process global leak | 2.30.0 |
| GHSA-gv7g-jm28-cr3m | Jul 2026 | 8.7 | Arrow fn + Reflect.get | 2.31.5, 2.32.1 |
This is the third sandbox escape in n8n's expression layer since 2025, indicating systemic issues in the AST rewriting approach.
Frequently Asked Questions
Q: Does this affect n8n Cloud? A: The advisory doesn't specify. Contact n8n support or assume affected until confirmed patched.
Q: Can a Viewer role exploit this? A: No. Workflow edit permission (Editor or Owner) is required. Viewer and Runner roles cannot create/modify workflows.
Q: Is there a WAF rule for this? A: Detection via WAF is difficult — the exploit is a valid workflow expression. Host-based monitoring (process execution, credential access) is more reliable.
Q: What if I'm on 1.x? A: No patch for 1.x. Plan migration to 2.31.5 (LTS) immediately. 1.x reached end-of-life in 2025.
Q: How do I verify my version?
A: In n8n UI: Settings → About, or API: GET /rest/version, or CLI: n8n --version.
Key Takeaways
- Upgrade now — 2.31.5 (LTS) or 2.32.1 (current) are the only complete fixes
- Expression sandboxes are hard — n8n's third escape in 18 months shows AST rewriting is fragile
- Credential exposure is the real risk —
N8N_ENCRYPTION_KEYaccess decrypts everything - Least privilege matters — minimize workflow-editor accounts; use read-only roles where possible
- Monitor the host, not just the app — process execution, network connections, and file access reveal compromise better than application logs
Sources:
- n8n Security Advisory GHSA-gv7g-jm28-cr3m
- Security Joes: Breaking the Sandbox Again
- The Hacker News Coverage
- n8n Releases
- Fixed VariablePolyfill.ts (2.31.5)
Automated Transmission
This entry was synthesized and populated dynamically using native API integrations.