CVE-2026-77077: Improper Control of Generation of Code ('Code Injection') in n8n-io n8n
n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis functions but not internal module constructors such as EventEmitter, allowing an authenticated user with Code node access to exploit prototype pollution to execute arbitrary commands within the runner container. Because the polluted prototype is a process-wide object, the corruption persists across other tenants' Code node executions on the same shared runner. On v1.x instances without task runners enabled, Code node JavaScript runs directly in the main n8n process, where the impact could be higher.
AI Analysis
Technical Summary
CVE-2026-77077 is a code injection vulnerability in n8n's JavaScript task runner. The prototype-freezing routine fails to cover internal module constructors like EventEmitter, allowing an authenticated user with Code node access to exploit prototype pollution. This leads to arbitrary command execution within the runner container. The polluted prototype is process-wide, so the corruption affects other tenants sharing the same runner. On older v1.x versions without task runners enabled, the Code node runs directly in the main n8n process, potentially increasing the severity of impact.
Potential Impact
An authenticated user with Code node access can execute arbitrary commands within the runner container, potentially affecting other tenants sharing the same runner due to process-wide prototype pollution. On v1.x instances without task runners, the impact could be more severe as the Code node runs in the main process. This could lead to unauthorized command execution and compromise of the affected system.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Code node access to trusted users only and consider isolating runners to prevent cross-tenant impact.
CVE-2026-77077: Improper Control of Generation of Code ('Code Injection') in n8n-io n8n
Description
n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis functions but not internal module constructors such as EventEmitter, allowing an authenticated user with Code node access to exploit prototype pollution to execute arbitrary commands within the runner container. Because the polluted prototype is a process-wide object, the corruption persists across other tenants' Code node executions on the same shared runner. On v1.x instances without task runners enabled, Code node JavaScript runs directly in the main n8n process, where the impact could be higher.
CVSS v4.0
Score 7.2high
Affected software
pkg:github/n8n-io/n8nRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-77077 is a code injection vulnerability in n8n's JavaScript task runner. The prototype-freezing routine fails to cover internal module constructors like EventEmitter, allowing an authenticated user with Code node access to exploit prototype pollution. This leads to arbitrary command execution within the runner container. The polluted prototype is process-wide, so the corruption affects other tenants sharing the same runner. On older v1.x versions without task runners enabled, the Code node runs directly in the main n8n process, potentially increasing the severity of impact.
Potential Impact
An authenticated user with Code node access can execute arbitrary commands within the runner container, potentially affecting other tenants sharing the same runner due to process-wide prototype pollution. On v1.x instances without task runners, the impact could be more severe as the Code node runs in the main process. This could lead to unauthorized command execution and compromise of the affected system.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Code node access to trusted users only and consider isolating runners to prevent cross-tenant impact.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-20T10:51:39.784Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a86e706acd9273b498befb8
Added to database: 08/20/2026, 11:37:42 UTC
Last enriched: 08/20/2026, 11:52:38 UTC
Last updated: 08/20/2026, 21:08:21 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.