Code Execution Vulnerability in n8n Workflow Automation Platform
CVE-2026-86076
Key Information:
Badges
What is CVE-2026-86076?
A vulnerability in n8n, an open-source workflow automation platform, was identified where earlier versions permitted dynamic binding through a sanitizer that failed to reject reserved class member names. Specifically, a class field named '__sanitize' could effectively rebind the sanitizer, allowing potential execution of backend code and JavaScript in the editor preview. The vulnerability lies within the PrototypeSanitizer in the expression sandboxing component of n8n. This issue has been resolved in subsequent versions 1.123.76, 2.37.7, and 2.38.2.
Affected Version(s)
n8n >= 2.38.0, < 2.38.2 < 2.38.0, 2.38.2
n8n >= 2.0.0, < 2.37.7 < 2.0.0, 2.37.7
n8n < 1.123.76 < 1.123.76
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.