The popular open-source automation platform **n8n** has released patches for a critical high-severity vulnerability that could enable authenticated users to escape its expression sandbox and execute arbitrary operating-system commands. Discovered by security firm **Security Joes**, the flaw (**GHSA-gv7g-jm28-cr3m**) was found while probing a previous **n8n** fix for **CVE-2026-27577**, revealing a bypass that had gone unnoticed.  ### Affected Versions and Patches The vulnerability affects **n8n** versions `<2.31.5` and `>=2.32.0,<2.32.1`. **n8n** has addressed the issue in versions `2.31.5` and `2.32.1`. The flaw carries a **CVSS 4.0** score of 8.7, categorizing it as high severity. Administrators are strongly advised to update their **n8n** instances immediately. While interim guidance suggested restricting instance access and workflow editing to fully trusted users, **n8n**'s advisory describes these as incomplete, short-term mitigations. ### Exploitation Details Exploitation of this vulnerability requires a valid account with permissions to create or modify workflows. Crucially, it does not require interaction from another user. A successful exploit would allow an attacker to execute commands with the privileges of the **n8n** process itself. **Security Joes** detailed in their report that such access could lead to the exposure of the `N8N_ENCRYPTION_KEY`, enabling the decryption of credentials stored within **n8n**. Furthermore, it could open pathways to connected databases, internal services, and cloud endpoints. ### Technical Breakdown of the Bypass **n8n** workflow builders leverage expressions like `={{ $json.email }}`. An abstract syntax tree rewriter is designed to redirect free JavaScript identifiers in these expressions to **n8n**'s controlled data context, preventing direct access to the **Node.js** runtime. **Security Joes** identified two key blind spots in this mechanism: 1. **ArrowFunctionExpression Handling**: In version `2.31.4`, the `VariablePolyfill.ts` file explicitly placed `ArrowFunctionExpression` in a no-op branch. This oversight allowed a concise arrow body, such as `() => process`, to resolve `process` to the real **Node.js** global object instead of its sandboxed counterpart. 2. **Reflect.get() Misdirection**: **n8n**'s property checks inspect static property names in member expressions. However, `Reflect.get()` receives the requested property as a function argument. Researchers exploited this distinction to recover `process.getBuiltinModule`, load `child_process`, and subsequently execute commands on the host system.  ### Remediation and Post-Exploitation Steps **Security Joes** tested their proof-of-concept against **n8n 2.30.4** successfully. The fix in `2.31.5` introduces a dedicated `ArrowFunctionExpression` handler that correctly routes bare identifiers in concise arrow bodies through the data context. Organizations using **n8n** should: * **Update Immediately**: Prioritize upgrading to `2.31.5` or `2.32.1`. * **Review Workflows**: Inspect recently created or modified workflows for unexpected arrow functions or obfuscated JavaScript. * **Monitor Processes**: Hunt for suspicious child processes like shells, **PowerShell**, `curl`, or `wget` spawned by the **n8n** or **Node.js** process. * **Rotate Credentials**: If suspicious workflow execution or host command activity is detected, rotate all credentials potentially exposed via **n8n**. This finding continues a series of expression-sandbox escapes patched by **n8n** since 2025, underscoring the ongoing challenge of maintaining secure sandboxed environments in complex automation platforms.