n8n sandbox escape: patch your automation server now

If you run a small business on automation, there's a good chance n8n is somewhere in the stack — connecting your CRM to your invoicing to your Slack, holding every API key you own. A new n8n sandbox escape rated CVSS 8.7 means anyone who can edit a workflow on your instance can run operating-system commands on the box underneath it. The patch is out. The question is whether you've applied it.

What actually happened

The flaw is tracked as GHSA-gv7g-jm28-cr3m — no CVE assigned as of this week. n8n's advisory titles it plainly: expression sandbox escape via arrow-function bodies enabling command execution. n8n lets you drop JavaScript expressions into workflow fields, and those expressions are supposed to run inside a sandbox. Arrow-function bodies walked straight out of it.

Affected versions are anything below 2.31.5, plus the 2.32.0 line below 2.32.1. Both patched releases shipped July 22. Security Joes found the bug on July 14 while probing n8n's February fix for CVE-2026-27577 for another bypass, and reported it the next day — The Hacker News covered the disclosure.

Read the CVSS vector and the shape gets clear: PR:L/UI:N — low privileges required, no user interaction. A successful exploit runs commands as the n8n process, which means encryption keys, stored credentials, and whatever databases and cloud endpoints that process can reach. n8n's suggested workaround is restricting workflow editing to trusted users, and the advisory says out loud that this is incomplete.

Why an n8n sandbox escape matters for your business

Nobody had reported in-the-wild exploitation when Security Joes wrote it up. That is not the reassurance it sounds like. This is the second sandbox escape in the same subsystem in six months, found by a researcher who went looking for a bypass of the first one and found it in a day.

Here's the part operators get wrong. "Authenticated" sounds like a high bar until you count who has a login on your n8n instance: the ops contractor from last spring, a marketing hire who builds their own Zapier-style flows, the shared account somebody set up for a client demo. Every one of those is now a path to code execution on a server holding your Stripe key.

Three moves this week. Check your version and get to 2.31.5 or 2.32.1. Audit who actually has workflow-edit permissions and cut the list to people you'd hand a shell to. And get the instance off the open internet — automation servers belong behind a VPN or an identity-aware proxy, not on a public hostname with a login form.

Sources: n8n security advisory GHSA-gv7g-jm28-cr3m, The Hacker News.