CVE-2026-27495 is a critical vulnerability classified under CWE-94 (Improper Control of Generation of Code) affecting the n8n open source workflow automation platform. The flaw exists in the JavaScript Task Runner sandbox, which is designed to safely execute user-defined JavaScript code within workflows. Prior to fixed versions 2.10.1, 2.9.3, and 1.123.22, an authenticated user with permission to create or modify workflows can craft malicious JavaScript code that escapes the sandbox boundary, enabling arbitrary code execution on the host system. When n8n is configured with the default internal Task Runner mode, this vulnerability allows an attacker to gain full control over the underlying host, potentially leading to complete system compromise. In environments using external Task Runners (enabled via N8N_RUNNERS_ENABLED=true and N8N_RUNNERS_MODE=external), the attacker’s impact is limited to the Task Runner environment, but they may still access or disrupt other tasks running there. Exploitation requires only workflow modification privileges, no additional authentication or user interaction is needed, making it highly exploitable. The vulnerability has been assigned a CVSS 4.0 score of 9.4, reflecting its critical severity with network attack vector, low complexity, no privileges required beyond workflow permissions, and high impact on confidentiality, integrity, and availability. Although no known exploits in the wild have been reported yet, the potential for severe damage necessitates immediate remediation. The vendor recommends upgrading to the patched versions. If immediate upgrade is not feasible, temporary mitigations include restricting workflow creation and editing permissions to fully trusted users and switching to external Task Runner mode to reduce the attack surface. These mitigations do not fully eliminate risk and should only be considered stopgap measures until patching is completed.

The vulnerability allows an authenticated user with workflow creation or modification rights to execute arbitrary code outside the intended sandbox, leading to full host compromise on default internal Task Runner configurations. This can result in complete loss of confidentiality, integrity, and availability of the n8n host system, enabling attackers to deploy malware, exfiltrate sensitive data, disrupt automation workflows, or pivot to other network resources. In external Task Runner mode, the impact is confined to the runner environment but can still disrupt multiple workflows and potentially affect other tasks. Given n8n’s role in automating business-critical processes, exploitation could cause significant operational disruption, data breaches, and loss of trust. Organizations relying on n8n for automation in sectors such as finance, healthcare, manufacturing, and technology are at heightened risk. The ease of exploitation combined with the high privileges gained makes this vulnerability a critical threat to any organization using affected versions of n8n.

1. Upgrade n8n instances immediately to versions 2.10.1, 2.9.3, or 1.123.22 or later, which contain the patch for this vulnerability. 2. Restrict workflow creation and editing permissions strictly to fully trusted and vetted users to reduce the risk of malicious workflow injection. 3. Configure n8n to use external Task Runner mode (set N8N_RUNNERS_ENABLED=true and N8N_RUNNERS_MODE=external) to isolate task execution environments and limit the blast radius of potential exploits. 4. Monitor workflow changes and audit logs for suspicious activity indicative of exploitation attempts. 5. Employ network segmentation and host-based controls to limit access to n8n hosts and Task Runner environments. 6. Consider implementing runtime application self-protection (RASP) or endpoint detection and response (EDR) solutions to detect anomalous code execution. 7. Educate administrators and developers on the risks of granting workflow modification permissions and enforce the principle of least privilege. 8. Plan for rapid incident response and recovery procedures in case of compromise. These steps go beyond generic advice by focusing on permission management, runner configuration, and monitoring tailored to n8n’s architecture.