🟠 High | Source: The Hacker News
A high-severity sandbox escape vulnerability in the workflow automation platform n8n allows an authenticated user with workflow editing permissions to break out of the expression sandbox and execute arbitrary operating system commands directly on the host server. The flaw was discovered by Security Joes as a bypass of a previous February patch for CVE-2026-27577. Versions below 2.31.5 and between 2.32.0 and 2.32.1 are affected; users should upgrade to 2.31.5 or 2.32.1 immediately.
Security Architect’s Take: Upgrade all n8n instances to version 2.31.5 or 2.32.1 immediately, and audit who holds workflow editor permissions — this privilege is effectively equivalent to code execution on the host, so apply least-privilege principles and consider running n8n in an isolated container with a restricted security context to limit blast radius if exploited.
Original advisory: n8n Sandbox Escape Lets Workflow Editors Run OS Commands as the n8n Process