n8n has patched a high-severity sandbox escape in its workflow expression system that could let an authenticated editor run operating-system commands on the server, with fixes released in versions 2.31.5 and 2.32.1. The issue affects releases earlier than 2.31.5 and 2.32.0 through 2.32.0, according to n8n’s security advisory.
KEY FACTS
- Affected versions Releases earlier than 2.31.5 and 2.32.0 through 2.32.0.
- Impact A successful exploit can execute commands with the privileges of the n8n process.
- Access needed An attacker needs a valid account that can create or modify workflows.
- Disclosure Security Joes found the flaw while probing an earlier patch for a different bypass.
The advisory says administrators should update rather than rely on interim guidance to restrict instance access and workflow editing to trusted users. It does not list a patched 1.x release and does not say whether n8n Cloud was affected.
Security Joes said access could expose N8N_ENCRYPTION_KEY and allow decryption of credentials stored in n8n. It could also open paths to connected databases, internal services, and cloud endpoints. The firm had not observed exploitation in the wild when its report was prepared.
The technical issue involved n8n’s expression sandbox, where workflow builders use JavaScript-like expressions that are rewritten to controlled data context. In version 2.31.4, an arrow function path could leave a bare identifier such as process untransformed, while property checks could be bypassed with Reflect.get() to reach Node.js builtins and load child_process.
Researchers identified the residual escape on July 14 and reported it the next day through the vendor’s disclosure program. n8n published fixed releases on July 22. The company and the researchers said defenders should review recently changed workflows for unexpected arrow functions or obfuscated JavaScript and look for shells, PowerShell, curl, or wget spawned by the n8n or Node.js process.
WHY IT MATTERS
The flaw matters because a workflow editor account can become a path to server-level command execution and access to secrets or internal systems. In deployments where n8n can reach sensitive services or stores privileged credentials, a compromise could extend well beyond the automation platform.