9.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27577

CVE-2026-27577: n8n: Expression Sandbox Escape Leads to RCE

n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, additional exploits in the expression evaluation of n8n have been identified and patched following CVE-2025-68613. An authenticated user with permission to create or modify workflows could abuse crafted expressions in workflow parameters to trigger unintended system command execution on the host running n8n. The issues have been fixed in n8n versions 2.10.1, 2.9.3, and 1.123.22. Users should upgrade to one of these versions or later to remediate all known vulnerabilities. If upgrading is not immediately possible, administrators should consider the following temporary mitigations. Limit workflow creation and editing permissions to fully trusted users only, and/or deploy n8n in a hardened environment with restricted operating system privileges and network access to reduce the impact of potential exploitation. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27577

CVE-2026-27577:

9.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
n8n	npm	< 1.123.22	1.123.22
n8n	npm	>= 2.0.0, < 2.9.3	2.9.3
n8n	npm	>= 2.10.0, < 2.10.1	2.10.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the security patches indicates multiple sandbox escape vulnerabilities within n8n's expression evaluation engine, affecting both JavaScript and Python environments, as well as an SQL injection vulnerability in the Merge node. The primary vectors for RCE involved abusing the spread operator on global objects, exploiting the extend() expression helper with unsafe property names, accessing the __objclass__ attribute in Python, and leveraging unsafe features in the alasql library. The patches address these by hardening the sandboxes: blocking access to sensitive properties and globals, rewriting the expression's AST to neutralize dangerous patterns, and disabling unsafe functionalities in third-party libraries. Additionally, several cross-site scripting (XSS) vulnerabilities were fixed by adding proper input sanitization. The identified vulnerable functions are the direct entry points where malicious user input (crafted expressions or parameters) is processed, leading to the vulnerabilities.

Vulnerable functions

Expression.evaluate

packages/workflow/src/expression.ts

This is the central function for evaluating user-supplied expressions. Before the patch, it was vulnerable to a sandbox escape. An attacker could provide a crafted expression, such as using the spread operator on the `process` object, to bypass sandbox protections and execute arbitrary commands on the host system.

findExtendedFunction

packages/workflow/src/extensions/expression-extension.ts

This function, used by the `extend()` expression helper, was vulnerable because it did not validate the property name being accessed. An attacker could use `extend()` to call unsafe properties like `constructor` or `__proto__`, leading to prototype pollution and sandbox escape for remote code execution.

TaskAnalyzer.validate

packages/@n8n/task-runner-python/src/task_analyzer.py

This function validates Python code for security issues before execution. It failed to block access to the `__objclass__` attribute, which is a known vector for sandbox escapes in certain Python environments, allowing an attacker to gain access to the underlying system and execute arbitrary code.

execute

packages/nodes-base/nodes/Merge/v3/actions/mode/combineBySql.ts

This function executes a user-provided SQL query using the `alasql` library for the Merge node. The library had dangerous features enabled by default, such as file access and code execution via the `REQUIRE` keyword. An attacker could craft a malicious SQL query to exploit these features and achieve remote code execution.

parseFormFields

packages/nodes-base/nodes/Form/utils/utils.ts

This function evaluates expressions within the 'html' fields of a Form node. It serves as an entry point for the expression engine. A malicious expression exploiting any of the sandbox escape vulnerabilities (like spread operator or extend() abuse) would be processed by this function, leading to RCE.

createPage

packages/@n8n/nodes-langchain/nodes/trigger/ChatTrigger/templates.ts

This function was vulnerable to Cross-Site Scripting (XSS). It used the `allowedFilesMimeTypes` parameter directly in the HTML output without sanitization, allowing an attacker to inject malicious scripts into the chat trigger page.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.