CVE-2026-86083: n8n code injection — HIGH

Q: Is CVE-2026-86083 actively exploited?

No confirmed active exploitation of CVE-2026-86083 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-86083?

Patch to n8n 1.123.76, 2.37.7, or 2.38.2 (or later) — the vendor confirms the fix removes reliance on the mutable global JSON.stringify during code generation. If immediate patching isn't possible, migrate affected workflows/expressions to the 'vm' expression engine, which the advisory confirms is not affected. Audit existing workflows for expressions built dynamically from external or untrusted input (webhook payloads, third-party workflow templates, multi-tenant user submissions) and treat any pre-patch instance accepting such input as higher risk. For detection, monitor n8n process logs and host-level EDR for unexpected child-process execution or anomalous behavior originating from the expression-evaluation step, and rotate credentials stored in n8n if a pre-patch instance was exposed to untrusted expressions.

Q: What systems are affected by CVE-2026-86083?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow orchestration pipelines.

Q: What is the CVSS score for CVE-2026-86083?

No CVSS score has been assigned yet.

CISO Take

n8n's legacy expression engine, used to power its automation workflows, generates source code by calling the global JSON.stringify function — and a crafted expression can override that global object, corrupting later code generation so attacker-controlled code gets executed instead of merely interpolated as a string. Because n8n is widely used to orchestrate AI agents and LLM-powered workflows, and often holds credentials for LLM APIs, databases, and third-party SaaS integrations, a successful exploit hands an attacker a foothold with access to everything the n8n instance can reach. There is no CVSS score, EPSS percentile, CISA KEV listing, or public proof-of-concept published yet, and exploitation requires non-trivial understanding of the expression engine's internals, so this is not a mass-exploited bug today — but the underlying flaw defeats the isolation the legacy engine was designed to provide, which is exactly the kind of sandbox-escape vendors patch quietly before researchers publish weaponized exploits. Teams running self-hosted n8n, especially multi-tenant instances or those evaluating expressions built from webhook or other external input, should upgrade to 1.123.76, 2.37.7, or 2.38.2 immediately rather than wait for exploitation evidence. As a stopgap, switch affected workflows to the newer 'vm' expression engine, which the advisory confirms is unaffected, and audit workflow logs for expressions that dynamically construct code from external data.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

High risk despite lacking CVSS/EPSS scoring or confirmed exploitation. The vulnerability is a code-injection sandbox escape (CWE-94) in a security-relevant component — the isolated-vm bridge that specifically exists to constrain untrusted expression execution — meaning a bypass has an unusually high ceiling: full code execution in the n8n process. Exploitability is currently gated by the need to understand the legacy engine's internal code-generation flow (JSON.stringify-based synthetic string generation), which is closer to advanced than trivial; no public exploit code or Nuclei template exists, and the bug is not in CISA KEV. However, because n8n is a high-adoption AI agent/workflow orchestration platform frequently exposed to webhook-driven or multi-tenant input, the realistic attack surface is broader than a typical internal-only bug, and the risk should be treated as high until patched.

How does the attack unfold?

Untrusted expression injection

Attacker submits or influences a workflow expression, via a shared template, marketplace workflow, or webhook-fed data, that overrides the global JSON.stringify function.

AML.T0049

Code-generation corruption

The legacy expression engine calls the now-hijacked JSON.stringify while generating source for synthetic string literals and timezone interpolation, embedding attacker-controlled code.

AML.T0050

Sandbox escape / code execution

The attacker-controlled code executes inside n8n's expression evaluation context (isolated-vm-bridge.ts), bypassing the isolation the sandbox was designed to enforce.

Credential and integration compromise

With code execution on the n8n host, the attacker accesses stored credentials for connected LLM APIs, databases, and other integrations, enabling broader compromise.

AML.T0112.000

Untrusted expression injection

Attacker submits or influences a workflow expression, via a shared template, marketplace workflow, or webhook-fed data, that overrides the global JSON.stringify function.

AML.T0049

Code-generation corruption

The legacy expression engine calls the now-hijacked JSON.stringify while generating source for synthetic string literals and timezone interpolation, embedding attacker-controlled code.

AML.T0050

Sandbox escape / code execution

The attacker-controlled code executes inside n8n's expression evaluation context (isolated-vm-bridge.ts), bypassing the isolation the sandbox was designed to enforce.

Credential and integration compromise

With code execution on the n8n host, the attacker accesses stored credentials for connected LLM APIs, databases, and other integrations, enabling broader compromise.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	< 1.123.76	`1.123.76`
204.1K OpenSSF 6.6 16 dependents Pushed 7d ago 53% patched ~5d to patch Full package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.4%

chance of exploitation in 30 days

Higher than 30% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Advanced

What should I do?

1 step

Patch to n8n 1.123.76, 2.37.7, or 2.38.2 (or later) — the vendor confirms the fix removes reliance on the mutable global JSON.stringify during code generation. If immediate patching isn't possible, migrate affected workflows/expressions to the 'vm' expression engine, which the advisory confirms is not affected. Audit existing workflows for expressions built dynamically from external or untrusted input (webhook payloads, third-party workflow templates, multi-tenant user submissions) and treat any pre-patch instance accepting such input as higher risk. For detection, monitor n8n process logs and host-level EDR for unexpected child-process execution or anomalous behavior originating from the expression-evaluation step, and rotate credentials stored in n8n if a pre-patch instance was exposed to untrusted expressions.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Supply Chain Framework Agent AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system security

NIST AI RMF

MEASURE 2.7 - AI system security and resilience evaluation

OWASP LLM Top 10

LLM03 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-86083?

n8n's legacy expression engine, used to power its automation workflows, generates source code by calling the global JSON.stringify function — and a crafted expression can override that global object, corrupting later code generation so attacker-controlled code gets executed instead of merely interpolated as a string. Because n8n is widely used to orchestrate AI agents and LLM-powered workflows, and often holds credentials for LLM APIs, databases, and third-party SaaS integrations, a successful exploit hands an attacker a foothold with access to everything the n8n instance can reach. There is no CVSS score, EPSS percentile, CISA KEV listing, or public proof-of-concept published yet, and exploitation requires non-trivial understanding of the expression engine's internals, so this is not a mass-exploited bug today — but the underlying flaw defeats the isolation the legacy engine was designed to provide, which is exactly the kind of sandbox-escape vendors patch quietly before researchers publish weaponized exploits. Teams running self-hosted n8n, especially multi-tenant instances or those evaluating expressions built from webhook or other external input, should upgrade to 1.123.76, 2.37.7, or 2.38.2 immediately rather than wait for exploitation evidence. As a stopgap, switch affected workflows to the newer 'vm' expression engine, which the advisory confirms is unaffected, and audit workflow logs for expressions that dynamically construct code from external data.

Is CVE-2026-86083 actively exploited?

No confirmed active exploitation of CVE-2026-86083 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-86083?

Patch to n8n 1.123.76, 2.37.7, or 2.38.2 (or later) — the vendor confirms the fix removes reliance on the mutable global JSON.stringify during code generation. If immediate patching isn't possible, migrate affected workflows/expressions to the 'vm' expression engine, which the advisory confirms is not affected. Audit existing workflows for expressions built dynamically from external or untrusted input (webhook payloads, third-party workflow templates, multi-tenant user submissions) and treat any pre-patch instance accepting such input as higher risk. For detection, monitor n8n process logs and host-level EDR for unexpected child-process execution or anomalous behavior originating from the expression-evaluation step, and rotate credentials stored in n8n if a pre-patch instance was exposed to untrusted expressions.

What systems are affected by CVE-2026-86083?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow orchestration pipelines.

What is the CVSS score for CVE-2026-86083?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow orchestration pipelines

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

AML.T0112.000 Local AI Agent

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the legacy expression engine generated source text by calling the mutable global JSON.stringify while printing synthetic string literals and interpolating timezone data. An expression could replace JSON.stringify and cause later generated source to contain executable attacker-controlled code. The affected code-generation paths include packages/@n8n/expression-runtime/src/bridge/isolated-vm-bridge.ts and packages/@n8n/tournament/src/ExpressionBuilder.ts, and the issue does not affect the vm expression engine. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.

Exploitation Scenario

An attacker who can influence a workflow expression — for example by contributing a workflow template to a shared or marketplace n8n instance, or by controlling data that a workflow feeds into an expression, such as a webhook payload later interpolated into a string expression — crafts an expression that overrides the global JSON.stringify function. When the legacy expression engine next generates source code for a synthetic string literal or timezone interpolation, it calls the now-attacker-controlled JSON.stringify, causing the generated source to contain attacker-supplied executable code instead of an inert string. That code executes within n8n's expression evaluation context (isolated-vm-bridge.ts / ExpressionBuilder.ts), escaping the isolation the sandbox was meant to provide, and the attacker gains code execution with access to whatever credentials and integrations that n8n instance holds — including any connected LLM APIs, databases, or downstream AI agent tools.

Weaknesses (CWE)

CWE-94 Improper Control of Generation of Code ('Code Injection') Primary CWE-94 Improper Control of Generation of Code ('Code Injection') Primary CWE-94 Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.