CVE-2026-72765

n8n before 2.32.1 Remote Code Execution via Expression Sandbox Escape

State: Published
Severity: 8.7 High
Published: Aug 11, 2026
Updated: Oct 29, 2026
Reserved: Aug 10, 2026

Description

n8n before 2.31.5 and before 2.32.1 contain a sandbox escape vulnerability in expression evaluation. An authenticated user with permission to create or modify workflows can craft expressions using arrow-function bodies to bypass the expression sandbox, triggering system command execution on the host running n8n. The issue is fixed in versions 2.31.5 and 2.32.1.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	VulnCheck

Weaknesses

CWE-94 Improper Control of Generation of Code ('Code Injection')

Affected Products

Product	Versions
n8nn8n-io	2.32.0 to before 2.32.1Affected 2.32.1Not affected
n8nn8n-io	before 2.31.5Affected 2.31.5Not affected

References

GitHub Security Advisory (GHSA-gv7g-jm28-cr3m)vendor-advisory
VulnCheck Advisory: n8n before 2.32.1 Remote Code Execution via Expression Sandbox Escapethird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.