CVE-2026-86076 n8n-io CVE debrief

Who should care

Defenders and administrators responsible for n8n workflow automation platforms should assess exposure and prioritize patching or mitigation, especially in environments where n8n is used for workflow automation. They must review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance, and plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Why it matters

CVE-2026-86076 is a high-severity vulnerability in n8n that allows backend code execution and editor-preview JavaScript execution. Defenders should prioritize patching or mitigating this vulnerability, especially in environments where n8n is used for workflow automation.

• Backend code execution requires immediate patching or mitigation to prevent potential attacks.
• Editor-preview JavaScript execution can lead to unauthorized code execution in certain scenarios.
• The high CVSS score of 8.7 indicates a significant risk to affected systems.

Technical summary

The expression compiler sanitizer in n8n resolves through dynamically scoped 'this' and does not reject reserved class member names. A class field named __sanitize can rebind the sanitizer and reach the Function constructor, enabling backend code execution and editor-preview JavaScript execution. The affected AST hook is PrototypeSanitizer in packages/workflow/src/expression-sandboxing.ts. This issue allows for backend code execution and editor-preview JavaScript execution, posing a significant risk to affected systems.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in environments where n8n is used for workflow automation.

Recommended defensive actions

• Patch n8n to version 1.123.76, 2.37.7, or 2.38.2
• Review and update workflows to ensure secure input handling
• Monitor n8n instances for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its high CVSS score of 8.7 and affected versions. The issue is caused by the expression compiler sanitizer resolving through dynamically scoped 'this' and not rejecting reserved class member names.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.