GHSA-gv7g-jm28-cr3m: n8n expression sandbox bypass

Q: Is GHSA-gv7g-jm28-cr3m actively exploited?

No confirmed active exploitation of GHSA-gv7g-jm28-cr3m has been reported, but organizations should still patch proactively.

Q: How to fix GHSA-gv7g-jm28-cr3m?

Upgrade to n8n 2.31.5 or 2.32.1 (or later) as the primary remediation. If immediate upgrade isn't possible, restrict n8n instance access and workflow creation/editing permissions to fully trusted users only — note these are explicitly partial mitigations per the vendor advisory, not full fixes. For detection, audit existing and newly created workflows for expressions using arrow-function syntax that deviate from expected patterns, and monitor host-level process execution originating from the n8n service account for anomalous shell commands. Review credential scope for the n8n host/service account and rotate any secrets accessible from it as a precaution.

Q: What systems are affected by GHSA-gv7g-jm28-cr3m?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow orchestration pipelines.

Q: What is the CVSS score for GHSA-gv7g-jm28-cr3m?

No CVSS score has been assigned yet.

CISO Take

n8n's workflow expression engine fails to fully sandbox arrow-function syntax, letting any user with workflow creation or edit rights escape the sandbox and execute arbitrary system commands on the host running n8n. There's no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, so this isn't being mass-exploited today — but the bar to abuse is low (authenticated, low-privilege workflow author) and the payoff is full host compromise, which is severe in an automation platform that routinely holds API keys, database credentials, and integration secrets for downstream systems. n8n itself carries a mediocre OpenSSF Scorecard (6.6/10) and a history of 166 other CVEs, signaling a track record of security gaps worth factoring into vendor risk scoring. Upgrade to n8n 2.31.5 or 2.32.1 (or later) immediately; if you can't patch now, restrict instance access and workflow authoring to fully trusted users as an interim compensating control, and audit existing workflows for suspicious expressions using arrow-function syntax as a detection heuristic.

Sources: GitHub Advisory OpenSSF ATLAS

What is the risk?

High severity due to command execution impact, but tempered by the requirement for authenticated access with workflow creation/edit privileges — this is a privilege-escalation-style flaw rather than a remotely exploitable pre-auth RCE. No EPSS score, no CISA KEV listing, no known public exploit code or Nuclei scanning template exist yet, indicating exploitation has not been observed in the wild. However, the low complexity of the bypass (crafted arrow function expressions) combined with the high blast radius (full host command execution) means risk should be treated as elevated wherever workflow authoring is not tightly restricted to trusted personnel. n8n's weak OpenSSF Scorecard (6.6/10) and 166 historical CVEs in the package further suggest a pattern of recurring security debt in this platform.

How does the attack unfold?

Entry point

An authenticated user holding workflow creation or edit permissions crafts a malicious expression using arrow-function syntax within an n8n workflow.

AML.T0012

Sandbox bypass

The crafted arrow-function expression evades the expression sandbox's restrictions when the workflow is saved or run.

AML.T0105

Code execution

The bypass triggers execution of arbitrary system commands on the host running the n8n instance.

AML.T0050

Impact

The attacker gains host-level access, exposing credentials and enabling potential pivoting into connected systems and AI agent integrations.

AML.T0112

Entry point

An authenticated user holding workflow creation or edit permissions crafts a malicious expression using arrow-function syntax within an n8n workflow.

AML.T0012

Sandbox bypass

The crafted arrow-function expression evades the expression sandbox's restrictions when the workflow is saved or run.

AML.T0105

Code execution

The bypass triggers execution of arbitrary system commands on the host running the n8n instance.

AML.T0050

Impact

The attacker gains host-level access, exposing credentials and enabling potential pivoting into connected systems and AI agent integrations.

AML.T0112

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	>= 2.32.0, < 2.32.1	`2.32.1`
206.1K OpenSSF 6.7 Pushed 5d ago 53% patched ~5d to patch Full package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

Upgrade to n8n 2.31.5 or 2.32.1 (or later) as the primary remediation. If immediate upgrade isn't possible, restrict n8n instance access and workflow creation/editing permissions to fully trusted users only — note these are explicitly partial mitigations per the vendor advisory, not full fixes. For detection, audit existing and newly created workflows for expressions using arrow-function syntax that deviate from expected patterns, and monitor host-level process execution originating from the n8n service account for anomalous shell commands. Review credential scope for the n8n host/service account and rotate any secrets accessible from it as a precaution.

How is it classified?

Code Execution Agent Framework AML.T0050 - Command and Scripting Interpreter AML.T0105 - Escape to Host AML.T0112 - Machine Compromise

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MEASURE 2.7 - AI system security and resilience evaluated

OWASP LLM Top 10

LLM05 - Improper Output Handling

Frequently Asked Questions

What is GHSA-gv7g-jm28-cr3m?

n8n's workflow expression engine fails to fully sandbox arrow-function syntax, letting any user with workflow creation or edit rights escape the sandbox and execute arbitrary system commands on the host running n8n. There's no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, so this isn't being mass-exploited today — but the bar to abuse is low (authenticated, low-privilege workflow author) and the payoff is full host compromise, which is severe in an automation platform that routinely holds API keys, database credentials, and integration secrets for downstream systems. n8n itself carries a mediocre OpenSSF Scorecard (6.6/10) and a history of 166 other CVEs, signaling a track record of security gaps worth factoring into vendor risk scoring. Upgrade to n8n 2.31.5 or 2.32.1 (or later) immediately; if you can't patch now, restrict instance access and workflow authoring to fully trusted users as an interim compensating control, and audit existing workflows for suspicious expressions using arrow-function syntax as a detection heuristic.

Is GHSA-gv7g-jm28-cr3m actively exploited?

No confirmed active exploitation of GHSA-gv7g-jm28-cr3m has been reported, but organizations should still patch proactively.

How to fix GHSA-gv7g-jm28-cr3m?

Upgrade to n8n 2.31.5 or 2.32.1 (or later) as the primary remediation. If immediate upgrade isn't possible, restrict n8n instance access and workflow creation/editing permissions to fully trusted users only — note these are explicitly partial mitigations per the vendor advisory, not full fixes. For detection, audit existing and newly created workflows for expressions using arrow-function syntax that deviate from expected patterns, and monitor host-level process execution originating from the n8n service account for anomalous shell commands. Review credential scope for the n8n host/service account and rotate any secrets accessible from it as a precaution.

What systems are affected by GHSA-gv7g-jm28-cr3m?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow orchestration pipelines.

What is the CVSS score for GHSA-gv7g-jm28-cr3m?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow orchestration pipelines

MITRE ATLAS Techniques

AML.T0050 Command and Scripting Interpreter

AML.T0105 Escape to Host

AML.T0112 Machine Compromise

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM05

What are the technical details?

Original Advisory

## Impact An authenticated user with permission to create or modify workflows could abuse crafted expressions using arrow functions to bypass the expression sandbox, triggering unintended system command execution on the host running n8n. ## Patches The issue has been fixed in n8n versions 2.31.5 and 2.32.1. Users should upgrade to one of these versions or later to remediate the vulnerability. ## Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict n8n instance access to fully trusted users only. - Restrict workflow creation and editing permissions to fully trusted users only. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

Exploitation Scenario

An adversary who has obtained (or been granted) a low-privilege n8n account with workflow creation or editing rights — for example, a contractor, a compromised internal user, or an over-permissioned collaborator on a shared automation platform — crafts a workflow expression using arrow-function syntax specifically designed to escape the expression sandbox's restrictions. Upon saving or executing the workflow, the malicious expression triggers execution of arbitrary system commands on the underlying host. From there, the attacker can harvest credentials and API keys configured in other workflows (including those feeding AI agent pipelines), pivot to connected internal systems and third-party integrations, or establish persistence on the host for further compromise.

Weaknesses (CWE)

CWE-94 Improper Control of Generation of Code ('Code Injection') Primary

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.