Code Injection Vulnerability in n8n Workflow Automation Platform
CVE-2026-86083
7.7HIGH
What is CVE-2026-86083?
n8n, an open-source workflow automation platform, was found to be vulnerable due to its legacy expression engine. This vulnerability arises from the engine's reliance on a mutable global JSON.stringify method to generate source text, which could be manipulated by an attacker. By replacing JSON.stringify, an attacker could potentially inject executable code into later generated output. The affected code paths are located in bridge and expression builder files, and users are advised to upgrade to versions 1.123.76, 2.37.7, or 2.38.2 to mitigate this risk.
Affected Version(s)
n8n >= 2.38.0, < 2.38.2 < 2.38.0, 2.38.2
n8n >= 2.0.0, < 2.37.7 < 2.0.0, 2.37.7
n8n < 1.123.76 < 1.123.76