Affected Systems

n8n workflow automation platform versions <2.31.5 and 2.32.0 to <2.32.1. Exploitation requires authenticated workflow editor account. n8n Cloud impact status not disclosed. No patched 1.x release mentioned.

Exploitation Status

No active exploitation observed by Security Joes at time of disclosure. Proof-of-concept developed and tested against n8n 2.30.4. Public advisory does not confirm whether exploited before fix. Vulnerability disclosed July 15, 2026; patches released July 22, 2026.

Business Impact

Authenticated workflow editors can execute arbitrary OS commands with n8n process privileges. Successful exploitation exposes N8N_ENCRYPTION_KEY, enabling decryption of stored credentials. Attackers gain access to connected databases, internal services, and cloud endpoints reachable from n8n host. Particularly severe in deployments where n8n holds privileged credentials or accesses sensitive internal systems. CVSS 4.0 score: 8.7 (High). Vendor rates interim mitigations as incomplete.

Urgency

🔴 Immediate

Recommended Actions

  • Update n8n immediately to version 2.31.5 or 2.32.1 or later; do not rely on access restriction mitigations
  • Review all workflows created or modified since early July 2026 for unexpected arrow functions or obfuscated JavaScript expressions
  • Hunt for suspicious child processes (shells, PowerShell, curl, wget) spawned by n8n or Node.js processes in system logs
  • Rotate all credentials stored in n8n if suspicious workflow execution or host command activity is detected
  • Audit workflow editor account permissions and restrict to fully trusted users until patching is complete

---

# Threat Actor Context

Actor Profile

Security Joes is a cybersecurity research firm that discovered this vulnerability while conducting security analysis of n8n's automation platform. In this context, Security Joes acts as a vulnerability researcher and responsible disclosure partner, not as a threat actor. The firm identified the flaw (GHSA-gv7g-jm28-cr3m) while examining n8n's previous fix for CVE-2026-27577, demonstrating proactive security research methodology. Security Joes reported the vulnerability through n8n's vulnerability disclosure program on July 15, 2026, following responsible disclosure practices.

TTPs (Tactics, Techniques, Procedures)

The vulnerability enables authenticated attackers with workflow editor permissions to execute arbitrary OS commands through an expression-sandbox escape. The exploit chain leverages two technical weaknesses: (1) ArrowFunctionExpression handling in VariablePolyfill.ts that allowed concise arrow bodies like () => process to resolve to the real Node.js global instead of sandboxed values, and (2) property check bypasses using Reflect.get() to recover process.getBuiltinModule, load child_process, and execute host commands. This maps to MITRE ATT&CK T1059 (Command and Scripting Interpreter) for arbitrary command execution and T1552.001 (Credentials In Files) for potential exposure of N8N_ENCRYPTION_KEY and stored credentials. The attack requires valid credentials with workflow creation/modification permissions but no user interaction.

Targets & Patterns

The vulnerability affects n8n automation platform deployments in versions <2.31.5 and >=2.32.0,<2.32.1. Exploitation targets authenticated users with workflow editor permissions within n8n instances. The impact is particularly severe in enterprise deployments where n8n stores broadly privileged credentials or has access to sensitive internal systems, connected databases, internal services, and cloud endpoints. Organizations using n8n for workflow automation with access to critical infrastructure are at elevated risk, as successful exploitation executes commands with the privileges of the n8n process and can expose encryption keys used to protect stored credentials.

Historical Context

This vulnerability extends a series of expression-sandbox escapes that n8n has patched since 2025. It directly follows CVE-2026-27577, a CVSS 9.4-rated critical sandbox escape fixed in February 2026, where the process object bypassed identifier-rewriting protections. Security Joes discovered GHSA-gv7g-jm28-cr3m while analyzing n8n's fix for CVE-2026-27577, identifying residual bypass opportunities on July 14, 2026. The pattern indicates persistent challenges in securing n8n's expression evaluation sandbox against JavaScript runtime escapes. Security Joes initially estimated this flaw would achieve a 9.4 Critical rating similar to CVE-2026-27577, though n8n assigned it a CVSS 4.0 score of 8.7 (High). No exploitation in the wild was observed when Security Joes prepared their report.

Defensive Recommendations

  • Immediately update n8n to version 2.31.5 or 2.32.1 or later; do not rely on interim mitigations restricting instance access as these are incomplete
  • Review recently created or modified workflows for unexpected arrow functions, obfuscated JavaScript, or suspicious expression syntax that may indicate exploitation attempts
  • Hunt for child processes spawned by n8n or Node.js processes, specifically looking for shells, PowerShell, curl, or wget execution using process monitoring tools (T1059 detection)
  • Rotate all credentials stored in n8n where suspicious workflow execution or host command activity is detected, as N8N_ENCRYPTION_KEY exposure could enable credential decryption
  • Implement strict access controls limiting workflow creation and modification permissions to fully trusted users, and monitor workflow edit activity for anomalous patterns