CVE-2026-85165 is an expression sandbox bypass in n8n (CVSS 9.9, critical). A user who can edit workflows could reach process globals from an expression. Upgrade to n8n 2.36.2 or, on the 2.35 line, 2.35.4. The sections below cover affected versions, how to check your exposure and what to do first.
What's affected
The advisory lists n8n versions before 2.36.2, and before 2.35.4 on the 2.35 line. Patched versions are 2.36.2 and 2.35.4. The weakness is CWE-95, code injection through dynamic evaluation.
The cause: the expression sandbox did not rewrite free identifiers in spread, computed key, switch case and class extension positions, so they resolved against process globals. The advisory says over thirty host globals were reachable. Exploitation needs an authenticated user with workflow edit permission, and changes persisted across later evaluations until restart. The record is not in the CISA KEV catalog.
How to check if you're exposed
Check the version in the n8n interface under settings, or from a terminal.
n8n --version
In Docker, read the image tag. Anything below 2.36.2, or below 2.35.4 if you track that line, is affected. Also list which users hold workflow edit permission.
What to do now
- Upgrade to n8n 2.36.2 or 2.35.4 or later.
- Review who has workflow edit permission and remove it from anyone who does not need it.
- Until you upgrade, restrict the instance to fully trusted users, as the advisory suggests.
- On self hosted deployments, restart the n8n process to clear any accumulated changes.
- Treat these steps as short term only. They do not fully remove the risk.
Why it matters
Expression sandboxes work by rewriting code so that it can only see a safe set of names. The bug is a gap in that rewrite: some syntax positions were not covered, so names fell through to the real global scope.
The lesson for workflow tools is that anyone who can edit a workflow can run code in some form. Permission design matters as much as the sandbox.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does an attacker need an account?
Yes. The advisory says an authenticated user with workflow edit permission. That is why reviewing editor roles is part of the fix.
Sources
Last reviewed: 19 October 2026.
