CVE-2026-77077

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.69 n8n versions prior to 2.33.4 n8n versions prior to 2.34.1

Description A JavaScript task runner VM sandbox escape exists where the prototype-freezing routine fails to cover internal module constructors, such as EventEmitter. This allows an authenticated user with access to the Code node to use prototype pollution—a technique of modifying the base prototype of an object to affect all instances—to execute arbitrary commands within the runner container. Since the polluted prototype is a process-wide object, the corruption persists across other tenants' Code node executions on the same shared runner. In v1.x instances where task runners are disabled, the JavaScript in the Code node runs directly in the main n8n process, potentially increasing the impact.

Recommendations Update n8n to version 1.123.69 or later. Update n8n to version 2.33.4 or later. Update n8n to version 2.34.1 or later.