CVE-2026-77077: Improper Control of Generation of Code ('Code Injection') in n8n-io n8n

This vulnerability arises from the n8n JavaScript task runner's prototype-freezing routine, which protects globalThis functions but not internal module constructors like EventEmitter. An authenticated user with access to the Code node can exploit prototype pollution to execute arbitrary commands inside the runner container. The polluted prototype is process-wide, causing the corruption to persist across executions by other tenants on the same shared runner. In v1.x instances without task runners, the Code node executes JavaScript directly in the main n8n process, increasing potential impact.

An authenticated user with Code node access can achieve arbitrary command execution within the runner container. Because the prototype pollution affects a process-wide object, it can impact multiple tenants sharing the same runner, leading to cross-tenant code execution. On older v1.x instances without task runners, the vulnerability could allow code execution in the main n8n process, potentially increasing the severity of impact.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is applied, restrict Code node access to trusted users only to mitigate exploitation risk.