An important security update has been released for the n8n workflow automation platform, addressing a critical vulnerability that allowed authenticated users to execute operating system commands on the server. Discovered by Security Joes, this flaw was identified while analyzing n8n’s previous fix for CVE-2026-27577, prompting further investigation.
Details of the Vulnerability
The security issue affects n8n versions before 2.31.5 and between 2.32.0 and 2.32.1, with the problem rectified in versions 2.31.5 and 2.32.1. Classified as GHSA-gv7g-jm28-cr3m, this vulnerability received a high severity rating with a CVSS 4.0 score of 8.7. As of the latest update on July 27, 2026, no CVE number has been assigned.
Security Joes highlighted that exploitation required a legitimate account with workflow editing permissions. Once exploited, it allowed attackers to execute commands with the same privileges as the n8n process, potentially exposing sensitive information such as the N8N_ENCRYPTION_KEY and accessing connected databases and services.
Technical Aspects and Fix Implementation
n8n workflow creators often use expressions like ={{ $json.email }}, which are processed through a controlled data context. However, a vulnerability in processing arrow functions allowed certain expressions to resolve to Node.js global objects rather than sandboxed values. This issue was addressed by adding a dedicated handler to process these expressions securely.
Security Joes also discovered a weakness in n8n’s property checks, allowing the retrieval of certain Node.js modules. These findings were tested on n8n version 2.30.4 via both local and released workflow packages, leading to successful command execution on the host server.
Recommendations for Administrators
Administrators are strongly advised to update their n8n instances immediately to the fixed versions. n8n’s interim guidance to limit access to trusted users is considered insufficient as a long-term solution. It is also recommended that administrators review workflows for unexpected code patterns and rotate credentials if suspicious activity is detected.
Security Joes’ report underscores the importance of addressing vulnerabilities swiftly, as n8n continues to rectify expression-sandbox escapes since 2025. The most recent fix follows the February patch for CVE-2026-27577, which also involved similar issues with identifier rewriting.
Organizations using n8n should remain vigilant and ensure their systems are promptly updated to mitigate potential security risks.
