CVE-2026-77083 - n8n before 1.123.69 Code Node Sandbox Escape via Function.prototype Pollution

Back Back to CVE browser

MEDIUM

n8n before 1.123.69 Code Node Sandbox Escape via Function.prototype Pollution

Published Aug 20, 2026

6.0

MEDIUM

CVSS 4.0

EPSS 0.37%

Description

n8n is a workflow automation platform. In versions prior to 1.123.69, 2.33.4, and 2.34.1, the JavaScript Code node's VM sandbox did not freeze the sandbox's Function.prototype, allowing an authenticated user with the ability to create and execute workflows to pollute it from within a Code node execution and recover a reference to the host's globalThis, resulting in a sandbox escape. The full exploit chain additionally depends on specific modules being available as allowlisted imports in the deployment's configuration. The issue is fixed in versions 1.123.69, 2.33.4, and 2.34.1.

Affected products

Vendor N8n-IO Product N8n Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <1.123.69
- Version
  2.0.0
  Status
  affected
  Constraints
  <2.33.4
- Version
  2.34.0
  Status
  affected
  Constraints
  <2.34.1
- Version
  1.123.69
  Status
  unaffected
  Constraints
  -
- Version
  2.33.4
  Status
  unaffected
  Constraints
  -
- Version
  2.34.1
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

N8n-IO

N8n

unaffected

Version	Status	Constraints
0	affected	<1.123.69
2.0.0	affected	<2.33.4
2.34.0	affected	<2.34.1
1.123.69	unaffected	-
2.33.4	unaffected	-
2.34.1	unaffected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-1321

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-63271
Advisory
https://github.com/n8n-io/n8n/security/advisories/GHSA-c9c6-rq46-h25v
vendor-advisoryMitigationVendor Advisory
https://www.vulncheck.com/advisories/n8n-before-code-node-sandbox-escape-via-function.prototype-pollution
third-party-advisoryThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-63271		Advisory
https://github.com/n8n-io/n8n/security/advisories/GHSA-c9c6-rq46-h25v		vendor-advisoryMitigationVendor Advisory
https://www.vulncheck.com/advisories/n8n-before-code-node-sandbox-escape-via-function.prototype-pollution		third-party-advisoryThird Party Advisory