Understanding the n8n Expression Sandbox Escape
A critical security flaw has been discovered in n8n, a popular workflow automation platform. This vulnerability, tracked as CVE-2026-85169, allows an attacker to bypass security measures within the system’s expression sandbox. In simple terms, this means someone with specific permissions to build workflows could break out of the intended secure environment and execute their own harmful code directly on the n8n server. This kind of attack is very serious because it can lead to complete control over the affected system.
CVE Details
- Product Name: n8n
- Published: September 3, 2026
- Severity: High
- Status: Analyzed
Affected Products
This vulnerability impacts several versions of n8n. If you are using any of the following, your system is at risk:
- n8n versions prior to 1.123.73
- n8n versions prior to 2.35.4
- n8n versions prior to 2.36.2
Current Status
The vulnerability has been thoroughly analyzed, and its impact is well understood. This “Analyzed” status means that security researchers have investigated the issue and confirmed its nature and potential for exploitation.
Severity Level
CVE-2026-85169 is rated with a CVSS score of 8.8 out of 10, classifying it as a High severity vulnerability. This high score indicates that successful exploitation could have a significant and devastating impact, potentially compromising the confidentiality, integrity, and availability of your n8n instance and the data it processes.
Possible Solutions
Addressing this vulnerability promptly is crucial to protect your n8n environment. Here are the recommended steps:
Patches and Updates
The most effective solution is to update your n8n installation to a patched version. The issue has been fixed in versions 1.123.73, 2.35.4, and 2.36.2, and all subsequent releases. Users should upgrade to one of these versions or later as soon as possible to mitigate the risk.
Temporary Workarounds
If immediate upgrading is not feasible, consider implementing these temporary mitigation measures, but be aware they do not fully eliminate the risk:
- Restrict Access: Limit access to your n8n instance strictly to fully trusted users only. This reduces the pool of potential attackers who might have the “workflow-build privilege” needed to exploit the flaw.
- Disable AI-Related Features: If AI-related nodes and features that utilize the `$fromAI` handler are not critical for your operations, consider disabling them temporarily.
- Least Privilege: Ensure that the n8n process runs under a dedicated operating system user account with the lowest possible privileges. This can help limit the potential damage if arbitrary code execution does occur.
References
For more technical details and official advisories, please refer to the following:
https://github.com/n8n-io/n8n/security/advisories/GHSA-9×83-43r8-5hwc
https://www.vulncheck.com/advisories/n8n-before-1.123.73-remote-code-execution-via-fromai-prototype-leak
