CVE-2026-72769 is a prototype pollution flaw in the n8n VM expression engine. A user who can edit workflow expressions can reach a host built-in and pollute its prototype in the main process. The record scores it 8.1, High, and names denial of service. Upgrade to 1.123.67, 2.31.5 or 2.32.1.
What's affected
The advisory lists affected versions as anything before 1.123.67 on the 1.x line, before 2.31.5 on the 2.31 line, and before 2.32.1 on the 2.32 line. The patched releases are 1.123.67, 2.31.5 and 2.32.1.
The advisory says both self-hosted and cloud instances that run the VM expression engine are affected. The attacker must be authenticated and able to create or edit a workflow expression. The record calls this a sandbox escape in the main n8n process.
The weakness class is CWE-1321, improperly controlled modification of object prototype attributes.
How to check if you're exposed
Find the version of every n8n instance you run, including containers and any copy bundled in another product.
n8n --version
docker exec <container-name> n8n --version
npm ls n8n
If the version is below the patched release for your line, you are in the affected range. Remember that n8n often runs as a base image tag in Docker or Kubernetes, so check image tags in your manifests as well as running hosts. A dependency scan of the repository that holds your deployment files will surface pinned n8n packages. The free in-browser scan at gold.safeguard.sh/scan accepts a manifest and lists known CVEs for what it finds.
The advisory also lists a workaround that suggests how to scope your exposure. It tells administrators to disable the VM expression engine if an alternative is available for their deployment, and to restrict instance access to fully trusted users. Ask who on your team can edit expressions, since those accounts are the ones that matter.
What to do now
- Upgrade n8n to 1.123.67, 2.31.5 or 2.32.1 or later.
- Limit instance access to fully trusted users until the patch is applied.
- If an alternative to the VM expression engine is available for your deployment, consider it as a short term measure.
- Review the list of accounts that can create or edit workflows and remove ones that no longer need that right.
- Watch for unexplained restarts or crashes of the main n8n process, which may point to misuse.
- Confirm the version on every instance after the upgrade.
Why it matters
In JavaScript, objects inherit from prototypes, and a change to a shared prototype changes every object that uses it. If a sandbox hands out a path to a real host built-in, code inside the sandbox can modify behaviour for the process outside it. That is why prototype pollution so often ends a sandbox.
The sources disagree on impact, and you should read both. The record says the issue leads to denial of service and scores it 8.1 High. VulnCheck repeats the denial of service wording and rates it medium at 6.1 under CVSS 4.0. The GitHub advisory title says the pollution leads to code execution, and rates it High at 8.7. Given that range, plan for the worse reading, which is code execution in the main process. No source reports exploitation in the wild, and the CVE is not on the CISA KEV list.
Quick check
Do the sources agree on what an attacker gains?
No. The record and VulnCheck say denial of service. The GitHub advisory title says code execution. Plan for the worse case.
Who can trigger it?
An authenticated user who can create or edit a workflow expression.
Sources
Last reviewed: 18 October 2026.
