In versions prior to 1.123.69, 2.33.4, and 2.34.1, the JavaScript Code node's VM sandbox did not freeze the sandbox's Function.prototype, allowing… (CVE-2026-77083)

The vulnerability in n8n affects the JavaScript Code node's VM sandbox where Function.prototype was not frozen, enabling an authenticated user with workflow execution rights to manipulate the prototype and escape the sandbox environment. This escape allows access to the host's globalThis object. Successful exploitation depends on the presence of certain allowlisted modules in the deployment. The vulnerability is addressed by fixes in versions 1.123.69, 2.33.4, and 2.34.1.

An authenticated user with the ability to create and execute workflows can escape the sandboxed JavaScript environment, potentially accessing the host environment's global context. This can lead to unauthorized code execution outside the intended sandbox, posing a confidentiality risk. The CVSS score of 5.9 reflects a moderate severity with high confidentiality impact but requires low privileges and high attack complexity.

The vulnerability is fixed in n8n versions 1.123.69, 2.33.4, and 2.34.1. Users should upgrade to these or later versions to remediate the issue. No additional mitigation steps are indicated beyond applying the official fixes.