JavaScript Task Runner VM Sandbox Escape in n8n by n8n.io

CVE-2026-77077

What is CVE-2026-77077?

Versions of n8n prior to 1.123.69, 2.33.4, and 2.34.1 exhibit a flaw in the JavaScript task runner that leads to a sandbox escape. The limited prototype-freezing routine does not adequately protect against internal module constructors like EventEmitter. This allows an authenticated user with access to Code nodes to exploit prototype pollution, resulting in the execution of arbitrary commands within the runner container. The ramifications are significant, as the polluted prototype remains a process-wide object, potentially compromising the integrity of other tenants' code executions sharing the same runner. Moreover, in n8n v1.x instances without enabled task runners, the JavaScript executed directly in the main n8n process heightens the associated risks.

References