CVE-2026-77083 n8n-io CVE debrief

Who should care

Users of n8n workflow automation platform, especially those with untrusted or low-trust users with workflow creation and execution capabilities, should prioritize patching to prevent potential sandbox escapes. Additionally, security teams and platform administrators should review their deployments and ensure that only trusted users have workflow creation and execution capabilities. This may involve reviewing user roles, access controls, and monitoring workflow executions for suspicious activity. Furthermore, affected operators and platform administrators should be aware of the potential operational impact and take steps to mitigate it. Vulnerability management teams should also review their processes to ensure that similar vulnerabilities are addressed promptly in the future. Lastly, defenders should verify that their deployments are not using vulnerable versions and that compensating controls are in place while remediation is scheduled and verified. This may involve reviewing logs, monitoring for suspicious activity, and implementing additional security measures to prevent exploitation. By taking these steps, organizations can reduce the risk associated with this vulnerability and protect their deployments from potential attacks. It is also essential to track exceptions, retest remediated assets, and close the item only after evidence is documented to ensure that the vulnerability is fully addressed. This requires a coordinated effort from various teams, including security, operations, and development, to ensure that the vulnerability is properly mitigated and that the organization's security posture is maintained. Overall, a thorough review of the deployment and a comprehensive mitigation plan are necessary to address this vulnerability effectively. This plan should include short-term and long-term measures to prevent exploitation and ensure the security of the deployment. By prioritizing patching and taking a proactive approach to vulnerability management, organizations can minimize the risk associated with this vulnerability and protect their deployments from potential attacks. The vulnerability management process should also be reviewed to ensure that it is

Technical summary

The JavaScript Code node's VM sandbox in n8n versions prior to 1.123.69, 2.33.4, and 2.34.1 did not freeze the sandbox's Function.prototype. This allows an authenticated user to pollute Function.prototype from within a Code node execution and recover a reference to the host's globalThis, resulting in a sandbox escape. The exploit chain requires specific modules to be allowlisted as imports in the deployment's configuration.

Defensive priority

Authenticated users with workflow creation and execution capabilities should prioritize patching to prevent potential sandbox escapes.

Recommended defensive actions

• Patch n8n to versions 1.123.69, 2.33.4, or 2.34.1.
• Restrict workflow creation and execution to trusted users.
• Monitor for suspicious workflow executions.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record indicates a medium-severity vulnerability in n8n workflow automation platform versions prior to 1.123.69, 2.33.4, and 2.34.1. An authenticated user can exploit a sandbox escape via Function.prototype pollution in the JavaScript Code node. Specific modules must be allowlisted in the deployment configuration for a full exploit chain.

Official resources