n8n Sandbox Escape Lets Workflow Editors Run OS Commands as the n8n Process

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-07-27 13:05 UTC
Importiert: 2026-08-01 08:26 UTC
CVSS: 9.4
Quelle-ID: thn_global
uid_hash: 92f44ce4760595606227823eacad882bbd14d6ab300dbc6e3e089ca191162d74

The Hacker News

Inhalt

n8n has patched a high-severity expression-sandbox escape that could let an authenticated workflow editor execute operating-system commands on the server running the automation platform. Security Joes found the flaw while probing n8n's February fix for CVE-2026-27577 for another bypass.

The affected ranges are <2.31.5 and >=2.32.0,<2.32.1. n8n fixed the flaw in versions 2.31.5 and

Verknuepfte CVEs

CVE-ID	Severity (Quelle)	CVSS (Quelle)	Severity (CVE.org)	CVSS (CVE.org)	EPSS	EPSS-Pctl	Veroeffentlicht (CVE.org)
CVE-2026-27577	CRITICAL	9.4	CRITICAL	9.4			2026-02-25

Quellen-Details

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
The Hacker News	thn_global	security_news		-	de	https://feeds.feedburner.com/TheHackersNews

Zurueck zur Eintrags-Liste