CVE-2026-72765CWE-94code-injection

CVE-2026-72765

Critical · published August 11, 2026

CVSS v3.1
9.9
EPSS
1%
Percentile
58.1
In the wild
Unconfirmed
What it is

n8n before 2.31.5 and before 2.32.1 contain a sandbox escape vulnerability in expression evaluation. An authenticated user with permission to create or modify workflows can craft expressions using arrow-function bodies to bypass the expression sandbox, triggering system command execution on the host running n8n. The issue is fixed in versions 2.31.5 and 2.32.1.

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00861 · 58.1th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-08-11T17:19Z
Affected products (2)
ProductVersionsFixed in
n8n/n8n≥ 2.31.0, < 2.31.52.31.5
n8n/n8nall versions—
References (2)
https://github.com/n8n-io/n8n/security/advisories/GHSA-gv7g-jm28-cr3m · [email protected]https://www.vulncheck.com/advisories/n8n-before-remote-code-execution-via-expression-sandbox-escape · [email protected]
EPSS history
Timeline
  • 11 AUG 12:17Z
    n8n before 2.32.1 Remote Code Execution via Expression Sandbox Escape
    cvelistv5