PT-2026-78938

CVE-2026-77083

Published

2026-08-20

Updated

2026-08-31

Description by

CVSS 4.0

6.0

Medium

MetricsAV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.69 n8n versions prior to 2.33.4 n8n versions prior to 2.34.1

Description An authenticated user with permissions to create and execute workflows can achieve a sandbox escape within the JavaScript Code node. This occurs because the VM sandbox fails to freeze the Function.prototype, enabling the user to pollute it during execution and recover a reference to the host's globalThis. The successful execution of this exploit chain requires specific modules to be configured as allowlisted imports in the deployment.

Recommendations Update n8n to version 1.123.69. Update n8n to version 2.33.4. Update n8n to version 2.34.1.

Exploitability

Exploit

Fix

Impacts

Researchers

Zolbooo

Vendors

Affected products

Weakness enumeration

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')

Related identifiers