CVE-2026-77083

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.69 n8n versions prior to 2.33.4 n8n versions prior to 2.34.1

Description An authenticated user with permissions to create and execute workflows can achieve a sandbox escape within the JavaScript Code node. This occurs because the VM sandbox fails to freeze the Function.prototype, enabling the user to pollute it during execution and recover a reference to the host's globalThis. The successful execution of this exploit chain requires specific modules to be configured as allowlisted imports in the deployment.

Recommendations Update n8n to version 1.123.69. Update n8n to version 2.33.4. Update n8n to version 2.34.1.