CVE-2026-72765: n8n expression sandbox escape

CISO Take

A sandbox escape in n8n's expression evaluation engine lets an authenticated user who can create or modify workflows craft arrow-function-body expressions that break out of the JavaScript sandbox and execute arbitrary system commands on the host running n8n. This matters because n8n is increasingly used to orchestrate AI agent workflows that hold live credentials to LLM APIs, vector databases, and internal systems, so host compromise can cascade into secrets theft and lateral movement well beyond the workflow tool itself. EPSS sits at 0.37% (top 70th percentile), there's no public exploit or Nuclei template, it's not in CISA KEV, and CISA's SSVC decision is TRACK — meaning exploitation pressure is currently low, but the requirement is only workflow-edit permission, not admin access, so low-privilege insiders or compromised editor accounts are a realistic path. Patch to n8n 2.31.5 or 2.32.1 immediately; until then, restrict who can create or edit workflows and audit existing workflows for suspicious arrow-function expressions.

Sources: NVD GitHub Advisory EPSS ATLAS CISA

What is the risk?

Technical severity is high — successful exploitation grants full arbitrary command execution on the host — but real-world risk is currently moderated by three factors: no public exploit code or scanner signature exists, CISA's SSVC decision is TRACK (lowest urgency tier), and the vulnerability requires an authenticated account with workflow create/modify rights rather than being remotely exploitable pre-auth. The realistic threat actors are malicious or compromised low-privilege editors, and organizations that grant broad workflow-editing access to contractors, junior staff, or shared service accounts carry disproportionate exposure. EPSS at 0.37% (top 70th percentile) reflects that broad opportunistic exploitation is unlikely absent a public PoC, but targeted abuse by an insider or an attacker who has already obtained editor-level credentials remains straightforward once the technique is known.

How does the attack unfold?

Initial Access

Attacker obtains or already holds an authenticated n8n account with permission to create or modify workflows.

AML.T0012

Sandbox Escape

Attacker crafts a workflow expression using an arrow-function body specifically designed to bypass n8n's expression sandbox.

AML.T0105

Command Execution

The crafted expression triggers arbitrary system command execution on the host running n8n when the workflow is executed.

AML.T0050

Impact

Attacker leverages host access to steal credentials from n8n's credential store and pivot into connected AI infrastructure such as LLM APIs and vector databases.

AML.T0112.000

Initial Access

Attacker obtains or already holds an authenticated n8n account with permission to create or modify workflows.

AML.T0012

Sandbox Escape

Attacker crafts a workflow expression using an arrow-function body specifically designed to bypass n8n's expression sandbox.

AML.T0105

Command Execution

The crafted expression triggers arbitrary system command execution on the host running n8n when the workflow is executed.

AML.T0050

Impact

Attacker leverages host access to steal credentials from n8n's credential store and pivot into connected AI infrastructure such as LLM APIs and vector databases.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	—	No patch
205.4K OpenSSF 6.7 Pushed 5d ago 53% patched ~5d to patch Full package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

9.9 / 10

EPSS

0.9%

chance of exploitation in 30 days

Higher than 57% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Changed

C High

I High

A High

What should I do?

1 step

Upgrade to n8n 2.31.5 (LTS branch) or 2.32.1 immediately — this is the only complete fix. Until patched, restrict workflow create/modify permissions to the smallest trusted group possible and review the n8n RBAC/user role assignments for over-provisioned editor accounts. Audit existing workflows for expressions containing arrow-function syntax that look anomalous or obfuscated. Monitor the n8n host for unexpected child processes spawned by the n8n Node.js process, and ensure n8n runs with least-privilege OS permissions (non-root, restricted filesystem/network access, ideally in an isolated container) so that even a successful sandbox escape has limited blast radius. Rotate any credentials stored in n8n's credential store if compromise is suspected.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Agent Framework AML.T0012 - Valid Accounts AML.T0050 - Command and Scripting Interpreter AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MANAGE-4.1 - Manage risks from third-party AI system components

Frequently Asked Questions

What is CVE-2026-72765?

A sandbox escape in n8n's expression evaluation engine lets an authenticated user who can create or modify workflows craft arrow-function-body expressions that break out of the JavaScript sandbox and execute arbitrary system commands on the host running n8n. This matters because n8n is increasingly used to orchestrate AI agent workflows that hold live credentials to LLM APIs, vector databases, and internal systems, so host compromise can cascade into secrets theft and lateral movement well beyond the workflow tool itself. EPSS sits at 0.37% (top 70th percentile), there's no public exploit or Nuclei template, it's not in CISA KEV, and CISA's SSVC decision is TRACK — meaning exploitation pressure is currently low, but the requirement is only workflow-edit permission, not admin access, so low-privilege insiders or compromised editor accounts are a realistic path. Patch to n8n 2.31.5 or 2.32.1 immediately; until then, restrict who can create or edit workflows and audit existing workflows for suspicious arrow-function expressions.

Is CVE-2026-72765 actively exploited?

No confirmed active exploitation of CVE-2026-72765 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-72765?

Upgrade to n8n 2.31.5 (LTS branch) or 2.32.1 immediately — this is the only complete fix. Until patched, restrict workflow create/modify permissions to the smallest trusted group possible and review the n8n RBAC/user role assignments for over-provisioned editor accounts. Audit existing workflows for expressions containing arrow-function syntax that look anomalous or obfuscated. Monitor the n8n host for unexpected child processes spawned by the n8n Node.js process, and ensure n8n runs with least-privilege OS permissions (non-root, restricted filesystem/network access, ideally in an isolated container) so that even a successful sandbox escape has limited blast radius. Rotate any credentials stored in n8n's credential store if compromise is suspected.

What systems are affected by CVE-2026-72765?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow orchestration pipelines, LLM API integrations.

What is the CVSS score for CVE-2026-72765?

CVE-2026-72765 has a CVSS v3.1 base score of 9.9 (CRITICAL). The EPSS exploitation probability is 0.86%.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow orchestration pipelinesLLM API integrations

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0050 Command and Scripting Interpreter

AML.T0112.000 Local AI Agent

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MANAGE-4.1

What are the technical details?

Original Advisory

n8n before 2.31.5 and before 2.32.1 contain a sandbox escape vulnerability in expression evaluation. An authenticated user with permission to create or modify workflows can craft expressions using arrow-function bodies to bypass the expression sandbox, triggering system command execution on the host running n8n. The issue is fixed in versions 2.31.5 and 2.32.1.

Exploitation Scenario

An attacker obtains editor-level access to an organization's n8n instance — either as a malicious contractor with legitimate workflow permissions, or by phishing/credential-stuffing a low-privilege employee account. They create or modify a workflow and insert an expression using an arrow-function body specifically structured to break out of n8n's expression sandbox, achieving arbitrary command execution on the underlying host when the workflow runs. From there, they read n8n's credential store to harvest API keys for connected LLM providers and vector databases, pivot across the internal network using discovered secrets, and potentially tamper with other automated workflows to establish persistence or exfiltrate data on an ongoing basis.

Weaknesses (CWE)

CWE-94 Improper Control of Generation of Code ('Code Injection') Primary CWE-94 Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.