HIGH

GHSA-hw8v-xxg5-vvvx

n8n: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code Execution

Quick fix

GHSA-hw8v-xxg5-vvvx — n8n: upgrade to the fixed version with the command below.

npm install n8n@1.123.76

Details

## Impact

The expression compiler's sanitizer resolved through a dynamically-scoped `this`, so a class field named `__sanitize` rebound it and reached the `Function` constructor. On the backend, any expression author could run code in the n8n process; in the editor preview, a member's expression could run as JavaScript in the session of whoever opened the workflow. The patch rejects reserved class-member names.

## Patches

The issue has been fixed in n8n versions 1.123.76, 2.37.7, and 2.38.2. Users should upgrade to one of these versions or later to remediate the vulnerability.

## Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict n8n instance access to fully trusted users only. - Avoid granting workflow-create or workflow-edit permissions to untrusted users. - Audit existing workflows for unexpected or unfamiliar expressions in node parameters. - Set `N8N_EXPRESSION_ENGINE=vm`.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.