CVE-2026-77077 n8n-io CVE debrief

Who should care

System administrators and security teams responsible for n8n workflow automation tool instances, especially those using versions before 1.123.69, 2.33.4, and 2.34.1, should be aware of this vulnerability and take steps to mitigate it.

Technical summary

The n8n workflow automation tool contains a JavaScript task runner VM sandbox escape vulnerability in versions before 1.123.69, 2.33.4, and 2.34.1. An authenticated user with Code node access can exploit prototype pollution to execute arbitrary commands within the runner container. This vulnerability allows for code execution within the container, potentially impacting multiple tenants on shared runner instances.

Defensive priority

Authenticated users with Code node access could exploit this vulnerability to execute arbitrary commands within the runner container, impacting multiple tenants.

Recommended defensive actions

• Inventory and verify n8n versions, especially those before 1.123.69, 2.33.4, and 2.34.1, to identify potential vulnerability.
• Restrict Code node access to authenticated users and monitor for suspicious activity.
• Apply patches or updates to n8n versions as recommended by the vendor.
• Implement compensating controls, such as network segmentation or access controls, to limit the impact of a potential exploit.
• Monitor for signs of prototype pollution or arbitrary command execution within the runner container.

Evidence notes

The CVE-2026-77077 record indicates that n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape vulnerability. An authenticated user with Code node access could exploit prototype pollution to execute arbitrary commands within the runner container. The impact could be higher on v1.x instances without task runners enabled, as Code node JavaScript runs directly in the main n8n process.

Official resources