CVE-2026-77083: n8n Code node sandbox escape

CISO Take

n8n's JavaScript Code node runs inside a VM sandbox that failed to freeze Function.prototype, letting an authenticated user pollute the sandbox's prototype chain and recover a reference to the host process's globalThis — a textbook sandbox escape. There is no CVSS score or EPSS data published, it isn't in CISA KEV, and no public exploit or Nuclei template exists, but n8n carries 16 tracked downstream dependents and 201 other CVEs on record, and its workflows routinely hold credentials for connected AI agents, APIs, and databases. Exploitation requires an authenticated account with workflow create/execute rights, and the full chain additionally depends on which external modules the deployment has allowlisted for Code node imports, so real-world blast radius varies by tenant configuration. Patch to 1.123.69, 2.33.4, or 2.34.1 immediately, and in the interim audit who holds workflow-editor roles and lock down NODE_FUNCTION_ALLOW_EXTERNAL/NODE_FUNCTION_ALLOW_BUILTIN to the minimum set of modules actually needed.

Sources:NVDGitHub AdvisoryATLASOpenSSFvulncheck.com

What is the risk?

Medium risk in practice despite the sandbox-escape severity of the underlying bug: the attacker must already be an authenticated user with permission to create and execute workflows, which limits this to insider-threat and compromised-account scenarios rather than remote unauthenticated exploitation. The 'full exploit chain' explicitly depends on deployment-specific allowlisted modules, so impact ranges from information disclosure (reading host process state via globalThis) up to full host code execution only where risky modules (e.g. child_process-style imports) are allowlisted. No CVSS vector, EPSS score, KEV listing, or public PoC exists yet, keeping near-term opportunistic exploitation likelihood low, but the vulnerability class (prototype pollution breaking VM isolation) is well understood and could be weaponized quickly once technical details circulate.

How does the attack unfold?

Initial Access

An attacker obtains or already holds an authenticated n8n account with permission to create and execute workflows.

AML.T0053

Sandbox Manipulation

The attacker adds a Code node containing JavaScript that pollutes the VM sandbox's Function.prototype.

Sandbox Escape

On workflow execution, the polluted prototype lets the attacker recover a reference to the host process's globalThis, escaping the intended VM isolation boundary.

AML.T0105

Impact

Depending on which modules the deployment has allowlisted, the attacker escalates to host code execution or reads sensitive host/process state, exposing credentials shared with connected AI agents and integrations.

Initial Access

An attacker obtains or already holds an authenticated n8n account with permission to create and execute workflows.

AML.T0053

Sandbox Manipulation

The attacker adds a Code node containing JavaScript that pollutes the VM sandbox's Function.prototype.

Sandbox Escape

On workflow execution, the polluted prototype lets the attacker recover a reference to the host process's globalThis, escaping the intended VM isolation boundary.

AML.T0105

Impact

Depending on which modules the deployment has allowlisted, the attacker escalates to host code execution or reads sensitive host/process state, exposing credentials shared with connected AI agents and integrations.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	—	No patch
209.2KOpenSSF 7.116 dependentsPushed yesterday44% patched~19d to patchFull package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.4%

chance of exploitation in 30 days

Higher than 30% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Advanced

What should I do?

1 step

Upgrade to n8n 1.123.69, 2.33.4, or 2.34.1 (or later) immediately — this is the only complete fix. As a compensating control until patched, restrict Code node creation/execution to trusted, vetted users via n8n's role-based permissions, and minimize the modules exposed through NODE_FUNCTION_ALLOW_EXTERNAL / NODE_FUNCTION_ALLOW_BUILTIN, since the full exploit chain depends on which modules are allowlisted. Review audit logs for recently created or modified workflows containing unusual Code node content (prototype-manipulation patterns, references to globalThis or Function.prototype), and rotate credentials stored in or accessible from the affected n8n instance if untrusted users had Code node access prior to patching.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionAuth BypassAgentPluginAML.T0053- AI Agent Tool Invocation AML.T0105- Escape to Host

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

NIST AI RMF

MEASURE 2.7-AI system security and resilience are evaluated and documented

Frequently Asked Questions

What is CVE-2026-77083?

n8n's JavaScript Code node runs inside a VM sandbox that failed to freeze Function.prototype, letting an authenticated user pollute the sandbox's prototype chain and recover a reference to the host process's globalThis — a textbook sandbox escape. There is no CVSS score or EPSS data published, it isn't in CISA KEV, and no public exploit or Nuclei template exists, but n8n carries 16 tracked downstream dependents and 201 other CVEs on record, and its workflows routinely hold credentials for connected AI agents, APIs, and databases. Exploitation requires an authenticated account with workflow create/execute rights, and the full chain additionally depends on which external modules the deployment has allowlisted for Code node imports, so real-world blast radius varies by tenant configuration. Patch to 1.123.69, 2.33.4, or 2.34.1 immediately, and in the interim audit who holds workflow-editor roles and lock down NODE_FUNCTION_ALLOW_EXTERNAL/NODE_FUNCTION_ALLOW_BUILTIN to the minimum set of modules actually needed.

Is CVE-2026-77083 actively exploited?

No confirmed active exploitation of CVE-2026-77083 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-77083?

Upgrade to n8n 1.123.69, 2.33.4, or 2.34.1 (or later) immediately — this is the only complete fix. As a compensating control until patched, restrict Code node creation/execution to trusted, vetted users via n8n's role-based permissions, and minimize the modules exposed through NODE_FUNCTION_ALLOW_EXTERNAL / NODE_FUNCTION_ALLOW_BUILTIN, since the full exploit chain depends on which modules are allowlisted. Review audit logs for recently created or modified workflows containing unusual Code node content (prototype-manipulation patterns, references to globalThis or Function.prototype), and rotate credentials stored in or accessible from the affected n8n instance if untrusted users had Code node access prior to patching.

What systems are affected by CVE-2026-77083?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation.

What is the CVSS score for CVE-2026-77083?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow automation

MITRE ATLAS Techniques

AML.T0053AI Agent Tool Invocation

AML.T0105Escape to Host

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

What are the technical details?

Original Advisory

n8n is a workflow automation platform. In versions prior to 1.123.69, 2.33.4, and 2.34.1, the JavaScript Code node's VM sandbox did not freeze the sandbox's Function.prototype, allowing an authenticated user with the ability to create and execute workflows to pollute it from within a Code node execution and recover a reference to the host's globalThis, resulting in a sandbox escape. The full exploit chain additionally depends on specific modules being available as allowlisted imports in the deployment's configuration. The issue is fixed in versions 1.123.69, 2.33.4, and 2.34.1.

Exploitation Scenario

An attacker who has obtained (or was granted) a standard n8n user account with workflow-editor rights — via a phishing-compromised credential, an over-provisioned contractor account, or a malicious insider — creates a new workflow containing a Code node with JavaScript that pollutes Function.prototype from inside the VM sandbox. On execution, this pollution lets the attacker recover a reference to the host process's globalThis, breaking out of the intended isolation boundary. If the instance has allowlisted a powerful module for Code node imports, the attacker chains this into arbitrary code execution on the host, allowing them to read other workflows' stored API keys and database credentials, pivot into connected AI agent tooling, or exfiltrate data the automation platform has access to.

Weaknesses (CWE)

CWE-1321Improperly Controlled Modification of Object Prototype AttributesPrimary CWE-1321Improperly Controlled Modification of Object Prototype Attributes

CWE-1321 — Improperly Controlled Modification of Object Prototype Attributes: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

[Implementation] By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
[Architecture and Design] By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.

Source: MITRE CWE corpus.