highCVE-2026-86083Sep 10, 2026

CVE-2026-86083: n8n Expression Sandbox Escape via JSON.stringify Hijacking

Rohit Hatagale
AI Security Researcher, SecureLayer7

An authenticated n8n user can overwrite the global JSON.stringify function inside a workflow expression, causing the legacy expression engine to generate and execute attacker-controlled JavaScript…

Packagen8n
Ecosystemnpm
Affected< 1.123.76
Fixed in1.123.76
CVE-2026-86083: n8n Expression Sandbox Escape via JSON.stringify Hijacking

The problem

n8n's legacy expression engine uses the mutable global JSON.stringify at code-generation time, both when printing synthetic string literals in ExpressionBuilder.ts and when interpolating timezone values into the per-evaluation wrapper in isolated-vm-bridge.ts.

Because those calls happen after user expressions have already run, an expression that replaces JSON.stringify with a function returning arbitrary source text effectively rewrites the code the engine compiles and executes next. The result is arbitrary code execution as the n8n process user.

Only the legacy expression engine (tournament-based) is affected; the default vm engine is not.

Proof of concept

A working proof-of-concept for CVE-2026-86083 in n8n, with the exact payload below.

javascript
{{ JSON.stringify = () => 'process.mainModule.require("child_process").execSync("id").toString()'; '' }}

The first expression replaces the global JSON.stringify with a function that returns a JavaScript code string instead of a quoted literal. When the code-generation stage in ExpressionBuilder.ts or isolated-vm-bridge.ts subsequently calls JSON.stringify to safely encode a string value or the timezone parameter into generated source, it receives raw executable code instead of a quoted string.

That code lands unquoted inside the generated source and executes in the Node.js host context.

The patch captures a private reference to the real JSON.stringify at module load time and uses only that frozen reference in both code-generation paths, so any later reassignment of the global has no effect on what source is generated.

The fix

Upgrade to n8n 1.123.76 (v1 branch), 2.37.7 (v2.37 branch), or 2.38.2 (v2.38 branch). If an immediate upgrade is not possible, set the environment variable N8N_EXPRESSION_ENGINE=vm to switch to the unaffected vm engine, and restrict workflow editing to fully trusted users only.

These workarounds are incomplete; upgrading is the only full remediation.

Reported by csuermann.

References: [1][2][3][4][5][6]

Related research