AI Threat AlertCVE-2026-85165: n8n: expression sandbox bypass mutates host globals
HIGHn8n's workflow expression evaluator fails to properly isolate free identifiers used in spread, computed-key, switch-case, and class-extension syntax, letting them resolve against Node.js process globals instead of the intended sandboxed scope — effectively an expression-sandbox escape (CWE-95). Any authenticated user with workflow-edit permission, a role many organizations grant broadly to non-security staff building automations, can mutate host objects and have those changes persist across every workflow execution until the n8n process restarts, turning a low-privilege editor into a process-wide attacker. With 16 downstream dependents, 211 other CVEs already recorded against n8n, and an EPSS score in the 83rd percentile despite no public exploit, no Nuclei template, and no CISA KEV listing, this sits in the "credible but not yet weaponized" band — the kind of flaw that gets a PoC quickly once researchers dissect the GHSA advisory. Because n8n is frequently wired into AI agent pipelines carrying embedded LLM API keys and service credentials, a process-wide mutation could taint every workflow sharing that instance, including ones with no relation to the malicious editor. Patch to n8n 2.36.2 immediately, and in the interim restrict workflow-edit permissions to trusted users and audit workflows for expressions using spread, computed-key, switch-case, or class-extension patterns referencing unexpected identifiers.
What is the risk?
No CVSS score is published, but the functional severity is meaningful: this is a sandbox-isolation break in an automation engine's expression evaluator, not a cosmetic bug. Exploitation requires an authenticated account with workflow-edit permission, which limits the blast radius to insiders, compromised low-privilege accounts, or shared multi-tenant n8n deployments where that permission is broadly granted. The raw EPSS score (0.00258) is low in absolute terms, but the 83rd percentile ranking indicates it is more likely to see attempted exploitation than most CVEs in the corpus. Absence from CISA KEV and no known public exploit or scanner template mean there is no evidence of active exploitation today, but the persistence characteristic (host object mutations survive until process restart) elevates real-world impact well beyond a typical single-request vulnerability once triggered.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| n8n | npm | — | No patch |
Do you use n8n? You're affected.
How severe is it?
What should I do?
1 stepUpgrade to n8n 2.36.2 or later immediately — this is the only complete fix. As an interim compensating control, restrict workflow-edit permission to a minimal, trusted set of users (least privilege) and avoid shared multi-tenant instances where teams with different trust levels can edit workflows on the same process. Audit existing workflows for expressions using spread (
...), computed object keys ([expr]:), switch-case, or classextendssyntax referencing identifiers that aren't clearly scoped/defined locally. Monitor for unexpected behavior changes across unrelated workflows after any workflow edit (a signal of persisted host-global mutation) and consider process restarts as a mitigating stopgap if compromise is suspected. Track GHSA-fg85-4wv2-p98j and the VulnCheck advisory for IOCs as they're published.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-85165?
n8n's workflow expression evaluator fails to properly isolate free identifiers used in spread, computed-key, switch-case, and class-extension syntax, letting them resolve against Node.js process globals instead of the intended sandboxed scope — effectively an expression-sandbox escape (CWE-95). Any authenticated user with workflow-edit permission, a role many organizations grant broadly to non-security staff building automations, can mutate host objects and have those changes persist across every workflow execution until the n8n process restarts, turning a low-privilege editor into a process-wide attacker. With 16 downstream dependents, 211 other CVEs already recorded against n8n, and an EPSS score in the 83rd percentile despite no public exploit, no Nuclei template, and no CISA KEV listing, this sits in the "credible but not yet weaponized" band — the kind of flaw that gets a PoC quickly once researchers dissect the GHSA advisory. Because n8n is frequently wired into AI agent pipelines carrying embedded LLM API keys and service credentials, a process-wide mutation could taint every workflow sharing that instance, including ones with no relation to the malicious editor. Patch to n8n 2.36.2 immediately, and in the interim restrict workflow-edit permissions to trusted users and audit workflows for expressions using spread, computed-key, switch-case, or class-extension patterns referencing unexpected identifiers.
Is CVE-2026-85165 actively exploited?
No confirmed active exploitation of CVE-2026-85165 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-85165?
Upgrade to n8n 2.36.2 or later immediately — this is the only complete fix. As an interim compensating control, restrict workflow-edit permission to a minimal, trusted set of users (least privilege) and avoid shared multi-tenant instances where teams with different trust levels can edit workflows on the same process. Audit existing workflows for expressions using spread (`...`), computed object keys (`[expr]:`), switch-case, or class `extends` syntax referencing identifiers that aren't clearly scoped/defined locally. Monitor for unexpected behavior changes across unrelated workflows after any workflow edit (a signal of persisted host-global mutation) and consider process restarts as a mitigating stopgap if compromise is suspected. Track GHSA-fg85-4wv2-p98j and the VulnCheck advisory for IOCs as they're published.
What systems are affected by CVE-2026-85165?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, agent orchestration pipelines.
What is the CVSS score for CVE-2026-85165?
No CVSS score has been assigned yet.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0012Valid AccountsAML.T0050Command and Scripting InterpreterAML.T0107Exploitation for Defense EvasionCompliance Controls Affected
What are the technical details?
Original Advisory
n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, or class-extension positions resolve against process globals. Authenticated users with workflow-edit permission can mutate host objects through expression evaluation, with changes persisting process-wide until restart.
Exploitation Scenario
An organization runs a shared self-hosted n8n instance where multiple business units build automations, some of which call LLM agent nodes using stored OpenAI/Anthropic API credentials. A user with workflow-edit rights — a junior analyst, contractor, or a compromised low-privilege account — creates a workflow with an expression such as a spread operator or computed object key referencing an identifier that isn't locally bound. Because the sandbox fails to isolate free identifiers in these syntactic positions, the identifier resolves against a Node.js process global instead of throwing an error or staying contained. The attacker uses this to mutate a shared global object, and that change persists for the lifetime of the n8n process, affecting every workflow executed afterward — including workflows owned by other teams with unrelated AI agent integrations and credentials. The attacker never needs elevated n8n roles or admin access; a routine workflow-edit permission is sufficient to compromise the entire shared automation platform.
Weaknesses (CWE)
CWE-95Improper Neutralization of Directives in Dynamically Evaluated CodePrimaryCWE-95Improper Neutralization of Directives in Dynamically Evaluated CodeCWE-95 — Improper Neutralization of Directives in Dynamically Evaluated Code: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").
- [Architecture and Design, Implementation] If possible, refactor your code so that it does not need to use eval() at all.
- [Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
Source: MITRE CWE corpus.
References
Timeline
Related Vulnerabilities
CVE-2026-3366310.0n8n: member role steals plaintext HTTP credentials
Same package: n8nCVE-2026-3366010.0TensorFlow: type confusion NPD in tensor conversion
Same package: n8nCVE-2026-2185810.0n8n: Input Validation flaw enables exploitation
Same package: n8nCVE-2026-275779.9n8n: Code Injection enables RCE
Same package: n8nCVE-2026-274949.9n8n: security flaw enables exploitation
Same package: n8n