CVE-2026-27495 is a critical (CVSS 9.9) code execution flaw in the n8n JavaScript Task Runner sandbox. An authenticated user who can create or modify workflows could run code outside the sandbox boundary. Upgrade to 2.10.1, 2.9.3 or 1.123.22, and limit who can edit workflows.
What's affected
n8n versions before 2.10.1, 2.9.3 and 1.123.22. The fixed releases are 2.10.1, 2.9.3 and 1.123.22, one for each release line.
With internal Task Runners, the default mode, the host could be fully compromised. With external Task Runners, an attacker might gain access to other tasks on the runner.
How to check if you're exposed
n8n --version
Check whether Task Runners are enabled and in which mode. The advisory points to the Task Runner documentation at https://docs.n8n.io/hosting/configuration/task-runners for the options. Then count the users who can create or edit workflows.
What to do now
- Upgrade n8n to 2.10.1, 2.9.3 or 1.123.22 or later.
- Limit workflow editing to fully trusted users.
- Consider external runner mode by setting N8N_RUNNERS_MODE to external, which limits the blast radius, as the advisory says.
- Remember that both workarounds are short term and do not fully remediate the risk.
- Audit workflows for code you did not write.
Why it matters
The weakness is CWE-94, code injection. The JavaScript runner is meant to confine user code, and a flaw in the sandbox let that code act outside the boundary.
Running user code is a core feature of automation platforms, so the sandbox is the main control. Keeping the editor group small and isolating runners cuts the damage while you patch. The record does not mark this CVE as known exploited. See also CVE-2026-27494 for the Python side of the same release.
Quick check
Does external runner mode fix the issue?
No. The advisory calls it a way to limit the blast radius, not a remedy. Upgrade.
Sources
- CVE-2026-27495 on Gold
- GitHub advisory listed in the record: https://github.com/n8n-io/n8n/security/advisories/GHSA-jjpj-p2wh-qf23
- Release listed in the record: https://github.com/n8n-io/n8n/releases/tag/n8n@2.10.1
Last reviewed: 19 October 2026.
