CVE-2026-72769 is a prototype pollution vulnerability in the VM expression engine of n8n before versions 1.123.67, 2.31.5, and 2.32.1. An authenticated user with permission to create or edit workflow expressions can abuse array-element access to gain a reference to a host built-in object and pollute its prototype within the main n8n process. This leads to a sandbox escape and can cause denial of service. The vulnerability affects both self-hosted and cloud deployments of n8n running the vulnerable VM expression engine.

Successful exploitation allows an authenticated user with workflow editing capabilities to escape the sandbox environment by polluting object prototypes in the main process. This can lead to denial of service conditions. There is no indication of remote unauthenticated exploitation or data confidentiality impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor n8n vendor communications for updates. Until a patch is available, restrict workflow editing permissions to trusted users only to reduce risk.