The vulnerability in n8n's JavaScript task runner arises because it shares a single module cache across all users executing Code nodes. A user with the ability to run a Code node can poison this shared cache, causing other users' Code-node executions on the same runner to be affected. This results in a cross-user isolation break within a single n8n instance, potentially impacting confidentiality, integrity, and availability of those executions. This issue does not constitute a sandbox escape or remote code execution. Only multi-user instances with the JS task runner and enabled built-in or external modules are vulnerable. The affected versions are all versions prior to 1.123.67, 2.31.5, and 2.32.1.

The vulnerability allows a user to influence or alter the execution environment of other users' Code nodes by poisoning the shared module cache. This breaks user isolation within the same n8n instance, potentially compromising confidentiality, integrity, and availability of Code-node executions for other users. However, it does not enable sandbox escape or remote code execution, limiting the scope of impact to cross-user contamination within the same instance.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, operators of multi-user n8n instances running the JavaScript task runner with modules enabled should consider restricting Code-node execution permissions or isolating users to prevent cache poisoning. Monitor vendor communications for official patches or updates.