Critical n8n sandbox escape exposes server secrets, high-severity CVE issued

Security researchers from a third party found a way to subvert n8n’s sandboxing mechanism used to safely evaluate user-provided JavaScript expressions. By crafting expressions that used template-like constructs, arrow functions and specific object frames, the researchers were able to coerce the evaluator into returning live global objects and ultimately run arbitrary commands on the host. The vulnerability allows an attacker who can create or modify a workflow — a capability available to non-privileged users in many deployments — to escalate a data transformation into full remote command execution. Successful exploitation can expose environment variables, stored credentials, API keys, OAuth tokens and configuration files, enabling lateral movement into cloud accounts and internal services tied to n8n instances. The issue was cataloged as CVE-2026-25049 and rated 9.4 on the CVSS scale, reflecting its potential for complete system compromise. The researcher disclosed the flaw to n8n in late December and the vendor issued an initial mitigation that blocked one bypass vector; however, a secondary bypass using unsanitized function arguments was quickly identified. Both the original escape and the subsequent bypass were addressed in the vendor’s 2.4.0 release, which strengthens the abstract syntax tree checks and tightens sanitization rules. Operators running self-hosted or cloud-hosted n8n are strongly urged to verify their version and apply the update, rotate exposed secrets, and audit workflows for suspicious transformations. The incident underscores how fragile JavaScript AST assumptions can be in security-critical sanitizers and highlights the risk of embedding user-definable code in automation platforms. For organizations that integrate n8n with cloud providers or internal APIs, this class of flaw raises the stakes: a single exploited workflow could pivot into broad access across connected systems. Moving forward, defenders should consider stricter role separation for workflow editing, runtime restrictions, and monitoring for unusual outbound activity from automation hosts. The rapid discovery of a bypass after the initial patch also suggests additional conservative hardening and broader review of expression evaluators across similar products.