Security Joes disclosed a high-severity sandbox escape vulnerability in n8n, an open-source workflow automation platform, on July 27, 2026. Tracked as GHSA-gv7g-jm28-cr3m with a CVSS score of 8.7, the flaw allows any authenticated n8n user with workflow creation or modification rights to execute operating system commands on the host server at the privilege level of the n8n process. The patch was released on July 22, 2026, five days before public disclosure.
How the n8n Expression Sandbox Fails at Arrow Functions and Reflect.get()
n8n’s expression sandbox is intended to let users write automation logic in a restricted JavaScript subset while blocking access to the underlying Node.js runtime and operating system. The sandbox enforces this by rewriting identifiers in user-written expressions before execution, substituting dangerous object references with sanitized versions before any code runs.
Two overlooked code paths defeat this protection entirely. The first involves arrow functions: when an arrow function appears inside a sandbox expression, the identifier rewriting step does not apply to the arrow function’s body, leaving references inside it unrewritten and reachable. The second path uses Reflect.get(), a JavaScript reflection method that retrieves object properties by passing the property name as a string. Because the identifier rewriting logic targets identifiers, not string-based property lookups, Reflect.get() bypasses the rewriting and exposes Node.js internals.
Combining these two paths, an authenticated attacker with workflow access can write an expression that appears to perform a routine automation task while breaking out of the sandbox entirely, reaching Node.js internals, and calling OS command execution at n8n process privileges. The payload can be embedded inside a workflow expression alongside legitimate logic, making it difficult to detect through visual inspection of workflow configurations.
Security Joes’ Discovery and the Link to Prior CVE-2026-27577 Bypass
Security Joes found GHSA-gv7g-jm28-cr3m while investigating a prior sandbox bypass tracked as CVE-2026-27577. The new vulnerability is not a variant of CVE-2026-27577 — it represents distinct overlooked code paths in the same sandbox — but the discovery context indicates that the research was a targeted review of the n8n sandbox’s completeness following the earlier bypass. The existence of a second distinct bypass found during review of the first suggests the sandbox architecture has recurring issues with comprehensive enforcement across all JavaScript expression forms.
As of July 27, n8n has not assigned a CVE identifier to GHSA-gv7g-jm28-cr3m.
n8n Versions 2.31.5 and 2.32.1 Address the Sandbox Escape
n8n released version 2.31.5 on July 22, 2026 after coordinating with Security Joes during responsible disclosure. Version 2.32.1 also contains the fix. Any n8n installation running a version below 2.31.5, as well as the 2.32.0 release, remains vulnerable. The 1.x release branch has no patched version available, meaning organizations on older n8n 1.x deployments cannot remediate through a point release and must migrate to the 2.31.5 or 2.32.1 line.
Exploitation requires a valid n8n account with the right to create or modify workflows. This limits exposure to internal users or any scenario where n8n instances are shared with external collaborators who have been granted workflow permissions.
Why n8n Sandbox Escapes Threaten Enterprise Automation Environments
n8n is deployed in enterprise environments to integrate SaaS applications, internal databases, and external APIs — and workflow configurations routinely contain privileged service credentials embedded directly in the automation logic. An authenticated user who escapes the sandbox can read those credentials, reach internal APIs accessible from the n8n server’s network position, pivot to connected services, and exfiltrate data flowing through integrated systems.
The attack payload can be concealed inside a workflow expression that performs a legitimate visible function — parsing a data field, reformatting output, or calling an API endpoint — alongside the hidden OS command execution. Because the malicious code executes at the n8n process privilege level, it can access all secrets, API keys, and connection strings stored in the n8n configuration on that server, not only those in the workflow where the exploit is embedded.
Organizations running n8n should upgrade to version 2.31.5 or 2.32.1 as the immediate remediation. Teams sharing n8n instances with multiple users or external collaborators should treat any workflow added or modified since before the patch date as potentially containing an exploit payload, and audit recent workflow changes alongside the upgrade to detect prior exploitation attempts.
