CVE-2026-86083 is a high severity code injection flaw in the legacy expression engine of n8n. Generated source relied on the mutable global JSON.stringify, so an expression could replace it and make later code attacker controlled. The vm engine is not affected. Upgrade to 1.123.76, 2.37.7 or 2.38.2.
What's affected
- Product: n8n, legacy expression engine (the isolated VM bridge and the expression builder).
- Affected: versions before 1.123.76, before 2.37.7 and before 2.38.2, only if they run the legacy expression engine.
- Fixed: 1.123.76, 2.37.7 and 2.38.2, or later. The vm expression engine, the default on the patched releases, is not affected.
Severity in the record: High, CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The GitHub advisory rates it High, 7.7 under CVSS v4. The record has 8.8 under CVSS v3.1.
Weakness class: CWE-94 (Code Injection).
How to check if you're exposed
- Find your version. For a global npm install,
n8n --versionprints it. For Docker, rundocker exec my-n8n n8n --version, or read the image tag. - Compare it with the fixed releases for your line, listed above.
- Find out which expression engine you run. The advisory names the
N8N_EXPRESSION_ENGINEenvironment variable. Instances on the legacy engine are the ones affected. - Note who can write expressions on the instance.
What to do now
- Upgrade to 1.123.76, 2.37.7, 2.38.2 or later.
- If you cannot upgrade, set
N8N_EXPRESSION_ENGINE=vm, which is not affected, then test your workflows. - Restrict the instance to trusted users and run n8n as a low privilege account.
- Review recent workflow changes for unfamiliar expressions.
- Plan to retire the legacy engine from your configuration.
Why it matters
When a program builds source text by calling a built in function, anything that can replace that function can change the result. Two code generation stages called the global JSON.stringify at generation time, once for string literals and once for a timezone value. An expression that swapped it turned plain data into executable source. The patch uses a reference captured when the module loads. The weakness is CWE-94.
The scope is narrow, since only the legacy engine is affected, and that makes the workaround clean. This is a pattern worth knowing: capture trusted built ins at load time, before user code runs. The record does not mark this CVE as exploited in the wild.
Quick check
Am I affected if I use the vm expression engine?
No. The advisory says the vm engine is not affected, and it is the default on the patched releases.
Sources
Last reviewed: 18 October 2026.
