"Neither alone is sufficient. Neither was covered by tests," Security Joes' research team said, summing up the two flaws that together let an authenticated n8n workflow editor break out of the platform's expression sandbox and run operating-system commands as the n8n process.
How the sandbox escape worked
n8n evaluates user-supplied expressions inside workflows using an abstract syntax tree (AST) rewriter that is supposed to route free JavaScript identifiers into a controlled data context rather than the raw Node.js runtime. Security Joes found two blind spots in that rewriting layer. First, in version 2.31.4 the file VariablePolyfill.ts placed ArrowFunctionExpression into an explicit no-op branch; a concise arrow body such as () => process could therefore resolve process to the real Node.js global instead of the sandboxed value. Second, n8n's property checks inspect static property names in member expressions, while Reflect.get() receives the requested property as a function argument. The researchers used that distinction to recover process.getBuiltinModule, load child_process, and run commands on the host.
Affected versions, disclosure timeline, and tracking
n8n fixed the residual escape in releases 2.31.5 and 2.32.1. The affected version ranges were <2.31.5 and >=2.32.0,<2.32.1. Researchers identified the residual escape on July 14, reported it through n8n's vulnerability disclosure program on July 15, and n8n published the fixed releases on July 22. The issue is tracked as GHSA-gv7g-jm28-cr3m and is rated High with a CVSS 4.0 score of 8.7; no CVE had been assigned as of July 27, 2026.
Potential impact on credentials, internal services, and cloud endpoints
Exploitation requires a valid account with permission to create or modify workflows and does not rely on any action from another user. A successful exploit executes commands with the privileges of the n8n process. Security Joes warned that access could expose the N8N_ENCRYPTION_KEY and allow decryption of credentials stored in n8n; it could also open paths to connected databases, internal services, and cloud endpoints. When the researchers prepared their report they had not observed exploitation in the wild; the public advisory does not say whether the flaw had been exploited prior to the fix.
Guidance for administrators and detection steps
n8n's advisory offers interim mitigations — restricting instance access and workflow editing to fully trusted users — but explicitly describes those controls as incomplete, short-term measures. Administrators are advised to update to the patched releases (2.31.5 or 2.32.1) rather than rely on the interim guidance. Defenders should review recently created or modified workflows for unexpected arrow functions or obfuscated JavaScript; they should also hunt for shells, PowerShell, curl, or wget processes spawned as children of the n8n or Node.js process. Where suspicious workflow execution or host command activity is found, credentials should be rotated. The advisory lists no patched 1.x release and does not say whether n8n Cloud was affected.
How workflow editors, defenders, and procurement teams should respond
- Workflow editors: If you have accounts that can create or modify workflows, assume those accounts are the primary risk vector in affected deployments. Remove or lock accounts not needed for development or automation, and review workflows for concise arrow functions or obfuscated JavaScript patterns described by the researchers.
- Defenders and incident responders: Prioritize updating affected instances to 2.31.5 or 2.32.1, hunt for unexpected child processes of the n8n/Node.js process, and rotate credentials where evidence of suspicious activity appears. Compare historical workflow packages and local instances (Security Joes tested 2.30.4) for similar constructs when triaging.
- Procurement and platform owners: Do not treat access restriction guidance as a long-term fix; require patched releases in procurement and deployment decisions, and ask vendors to clarify whether managed/cloud offerings (the advisory does not say if n8n Cloud was affected) were within the scope of the fix.
The residual escape is the latest in a string of expression-sandbox bypasses n8n has patched since 2025 and follows CVE-2026-27577, a 9.4-rated escape fixed in February after researchers found the process object slipping through the same identifier-rewriting layer. Administrators should treat the July 22 releases as the definitive remedy for the bug tracked as GHSA-gv7g-jm28-cr3m and act now to update, inspect workflows for the specific arrow-function and property-access patterns Security Joes detailed, and rotate keys where host-level command activity or suspicious workflow edits are discovered.
