Expression Sandbox Bypass in n8n by n8n-io

CVE-2026-85165

What is CVE-2026-85165?

n8n versions prior to 2.36.2 are susceptible to a significant vulnerability that allows authenticated users with workflow-edit permissions to bypass the expression sandbox. This occurs when free identifiers are utilized in spread, computed-key, switch-case, or class-extension contexts, which inadvertently resolve to process globals. As a result, users can manipulate host objects through expression evaluations, leading to persistent changes across the process until the next restart. This poses a risk to the integrity and security of workflows within n8n, making it essential to upgrade to the latest version to mitigate potential exploits.

References