CVE-2026-86076 is a high severity expression sandbox flaw in n8n. The sanitizer resolved through a dynamically scoped this and did not reject reserved class member names, so a crafted expression could reach the Function constructor. Upgrade to 1.123.76, 2.37.7 or 2.38.2, or switch to the vm expression engine.
What's affected
- Product: n8n, expression compiler sanitizer (
PrototypeSanitizer). - Affected: versions before 1.123.76, before 2.37.7 and before 2.38.2.
- Fixed: 1.123.76, 2.37.7 and 2.38.2, or later. All three were released on 2 September 2026.
- Impact: backend code execution, and JavaScript execution in the editor preview.
Severity in the record: High, CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The GitHub advisory rates it High, 8.7 under CVSS v4. The record has 8.8 under CVSS v3.1.
Weakness class: CWE-94 (Code Injection).
How to check if you're exposed
- Find your version. For a global npm install,
n8n --versionprints it. For Docker, rundocker exec my-n8n n8n --version, or read the image tag. - Compare it with the fixed releases for your line, listed above.
- Check which expression engine you use. The advisory names the
N8N_EXPRESSION_ENGINEenvironment variable, and says the valuevmis a workaround. - List users who can create or edit workflows.
What to do now
- Upgrade to 1.123.76, 2.37.7, 2.38.2 or later on your line.
- If you cannot upgrade yet, set
N8N_EXPRESSION_ENGINE=vm, as the advisory suggests. - Avoid giving workflow create or edit rights to people you do not trust.
- Audit existing workflows for unfamiliar expressions in node parameters.
- Restrict the instance to trusted users while you work.
Why it matters
The sanitizer rewrites expressions to block dangerous access. It looked up its own helper through a dynamically scoped this, so an expression that defines a class field with the helper's name could rebind it and walk to the Function constructor. The patch rejects reserved class member names. The weakness is CWE-94, code injection.
There are two impacts. On the server, any expression author can run code in the n8n process. In the editor, a member's expression could run as JavaScript in the session of whoever opens the workflow. That second path turns a shared workflow into a way to attack colleagues. Sandboxes need defense in depth. The record does not claim exploitation in the wild.
Try it yourself
Not every flagged package is reachable from your code. This demo shows how reachability analysis separates the two.
Click through it at your own pace, or open it full screen.
Quick check
Is switching to the vm engine enough?
The advisory lists it as a workaround, not a full remediation. Upgrade to a fixed release.
Sources
Last reviewed: 18 October 2026.
