CVE-2026-72765
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Vulnerability in n8n before versions 2.31.5 and 2.32.1 allows a sandbox escape in expression evaluation. An authenticated user with permission to create or modify workflows can craft expressions using arrow-function bodies to bypass the expression sandbox, triggering system command execution on the host running n8n. The issue is fixed in versions 2.31.5 and 2.32.1.
Risk Assessment
The risk includes arbitrary command execution on the server, potentially leading to full system compromise.
Recommendation
Immediately upgrade n8n to versions 2.31.5 or 2.32.1 which contain the fix.
Original NVD description (English source)
n8n before 2.31.5 and before 2.32.1 contain a sandbox escape vulnerability in expression evaluation. An authenticated user with permission to create or modify workflows can craft expressions using arrow-function bodies to bypass the expression sandbox, triggering system command execution on the host running n8n. The issue is fixed in versions 2.31.5 and 2.32.1.