CVE-2026-86083: CWE-94: Improper Control of Generation of Code ('Code Injection') in n8n-io n8n
Affects n8n-io n8nSource CVE Database V5
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.6% chance of exploitation in 30 days – higher than 51% of CVEs
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| n8n-ion8n | Affected
| Fixed in– |
AI-suggested
Upgrade n8n to version 1.123.76, 2.37.7, or 2.38.2 or later to apply the official fix. Avoid using the legacy expression engine if possible, as the vm expression engine is not affected by this vulnerability. Patch status is confirmed fixed in these versions.
Description
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the legacy expression engine generated source text by calling the mutable global JSON.stringify while printing synthetic string literals and interpolating timezone data. An expression could replace JSON.stringify and cause later generated source to contain executable attacker-controlled code. The affected code-generation paths include packages/@n8n/expression-runtime/src/bridge/isolated-vm-bridge.ts and packages/@n8n/tournament/src/ExpressionBuilder.ts, and the issue does not affect the vm expression engine. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.
Summary
The vulnerability in n8n's legacy expression engine allows an attacker to replace the global JSON.stringify function used during source code generation. This replacement can cause the engine to generate source code containing attacker-controlled executable code. The affected code paths are located in packages/@n8n/expression-runtime/src/bridge/isolated-vm-bridge.ts and packages/@n8n/tournament/src/ExpressionBuilder.ts. The issue is resolved in versions 1.123.76, 2.37.7, and 2.38.2. The vm expression engine is not affected by this vulnerability.
Impact
An attacker with the ability to influence expressions in the legacy expression engine could execute arbitrary code within the context of the n8n application. This could lead to unauthorized actions, data compromise, or further system compromise. The CVSS 4.0 score of 7.7 reflects high severity with network attack vector, low attack complexity, and partial privileges required.
Weaknesses
References
- github.com/n8n-io/n8n/security/advisories/GHSA-6xcw-7xm6-48c6 (opens in a new tab)
- github.com/n8n-io/n8n/releases/tag/[email protected] (opens in a new tab)
- github.com/n8n-io/n8n/releases/tag/[email protected] (opens in a new tab)
- github.com/n8n-io/n8n/releases/tag/[email protected] (opens in a new tab)
Community reviews
Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.