A serious security flaw has been found in n8n, a popular open-source platform for workflow automation. This vulnerability, identified as CVE-2026-86083, could allow an attacker to run malicious code on affected systems. It’s crucial for users to understand this risk and take immediate action.
The issue stems from n8n’s older expression engine, specifically how it handles certain operations like calling JSON.stringify while creating source code. An attacker could trick the system into replacing JSON.stringify with their own code. This manipulated code would then become part of the system’s executable processes, potentially leading to unauthorized control.
The affected parts of the code generation are primarily in packages/@n8n/expression-runtime/src/bridge/isolated-vm-bridge.ts and packages/@n8n/tournament/src/ExpressionBuilder.ts. Importantly, the newer VM expression engine is not impacted by this particular vulnerability.
CVE Details
Product: n8n
Published Date: September 8, 2026
Last Modified: September 11, 2026
Severity: HIGH
Status: Analyzed
Affected Products
This vulnerability impacts n8n versions prior to:
- 1.123.76
- 2.37.7
- 2.38.2
Current Status
The vulnerability has been thoroughly analyzed. The good news is that fixes are already available. Users should prioritize updating their n8n installations to mitigate the risk.
Severity Level
Rated as HIGH with a CVSS score of 8.8, this vulnerability poses a significant risk. A high severity rating indicates that exploiting this flaw could lead to critical consequences, such as unauthorized code execution, complete system compromise, or sensitive data breaches.
Possible Solutions
The primary solution is to update your n8n installation immediately. The developers have released patches that address this vulnerability. Please update to one of the following versions or newer:
- n8n version 1.123.76
- n8n version 2.37.7
- n8n version 2.38.2
If you are using an older version, make sure to check their official release notes and follow the recommended upgrade path. For those who might not be able to upgrade immediately, note that the vulnerability does not affect the newer “vm expression engine”. If your workflow can switch to this engine, it might offer some interim protection, but updating remains the most complete and recommended fix.
References
https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.76
https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7
https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2
https://github.com/n8n-io/n8n/security/advisories/GHSA-6xcw-7xm6-48c6
