CVE-2026-86083: Sandbox Escape and Remote Code Execution via Code-Printer Injection in n8n Legacy Expression Engine

The open-source workflow automation platform n8n relies on a dynamic expression engine to process, format, and execute inline scripts within node configurations. To protect the host operating system from untrusted execution, n8n historically evaluated these expressions inside sandboxed environments managed by the isolated-vm library. This system isolates JavaScript processes within constrained V8 runtime contexts separate from the primary Node.js process.

However, a design vulnerability exists in how the legacy expression engine formats and serializes code strings before passing them to the sandboxed runtime. The host-side bridge and Abstract Syntax Tree (AST) transpilation layers build executable source code by evaluating global JavaScript properties. This hybrid approach creates an insecure boundary where host-side routines interact with mutable, sandboxed properties.

This interaction exposes a significant attack vector known as Shared Builtin Tampering. If an attacker can manipulate core functions within the shared environment, they can intercept host-side code compilation. This interception enables the insertion of arbitrary instructions directly into the compilation pipeline, rendering the sandbox restrictions ineffective.

The vulnerability lies in n8n's reliance on the mutable, global JSON.stringify utility during two distinct code-generation stages: isolated-vm bridge execution and AST string-literal printing.

In the first stage, located in packages/@n8n/expression-runtime/src/bridge/isolated-vm-bridge.ts, the host-side runner compiles a wrapper code block. To configure the sandbox environment, this runner attempts to serialize timezone parameters using the global JSON.stringify command. Because JavaScript builtins are dynamically resolved on the current scope, an attacker can overwrite JSON.stringify with a malicious proxy function. When the bridge attempts to serialize the timezone metadata, the hijacked function executes instead, returning unescaped, arbitrary JavaScript code that is concatenated directly into the execution template.

In the second stage, located in packages/@n8n/tournament/src/ExpressionBuilder.ts, the expression transpiler leverages recast and ast-types to process AST structures. When the transpiler encounters a text or fallback string chunk, it generates standard Literal AST nodes using b.literal(). During the printing phase, the recast code printer calls JSON.stringify to format the AST literals. If the global JSON.stringify function has been overridden, the output printed by recast is corrupted with the attacker's payload. This dynamically transforms a safe string literal within the code representation into an active instruction block.

Because these processes execute before compilation inside the isolated-vm engine, the injected code is compiled and run with the full security context of the host process, resulting in a sandbox escape.

The vulnerability is remediated by capturing immutable references to JSON.stringify at module load time and modifying the AST literal printer to prevent dynamic global evaluations.

In the file packages/@n8n/expression-runtime/src/bridge/isolated-vm-bridge.ts, developers introduced a frozen reference to ensure serialization routines remain unaffected by subsequent prototype modifications:

// Captured at module load so values rendered into generated code stay stable
// even if the global is later replaced.
const safeStringify = JSON.stringify;

This frozen reference replaces the dynamic resolution call within the bridge execution loop:

// The bridge now serializes options securely
const timezone = options?.timezone ? safeStringify(options.timezone) : 'undefined';

To secure the AST serialization within the transpiler, n8n introduced a new helper, rawStringLiteral, in packages/@n8n/tournament/src/VariablePolyfill.ts:

const safeStringify = JSON.stringify;
 
export const rawStringLiteral = (value: string) => {
	const literal = b.literal(value);
	const raw = safeStringify(value)
		.replace(/\u2028/g, '\\u2028')
		.replace(/\u2029/g, '\\u2029');
	// Attach extra properties to prevent recast from invoking the dynamic global during print
	(literal as namedTypes.Literal & { extra?: { raw: string; rawValue: string } }).extra = {
		raw,
		rawValue: value,
	};
	return literal;
};

This ensures that when recast compiles the AST, it reads the pre-serialized extra.raw property verbatim rather than looking up the global JSON.stringify function, completely closing the code-printing injection vector.

An exploit targeting CVE-2026-86083 requires authenticated access to create or edit workflows on an n8n instance configured to run the legacy expression engine.

Initially, the attacker inputs an expression containing code designed to pollute the global scope and redefine the core stringify method. The malicious definition intercepts values and returns raw, unescaped JavaScript instructions:

JSON.stringify = function(val) {
    return `("UTC"); (function(){
        const exec = process.mainModule.require('child_process').execSync;
        exec('id');
    })()`;
};

When n8n rebuilds or compiles subsequent workflow expressions, the host environment processes the wrapper code in isolated-vm-bridge.ts. The bridge calls the poisoned JSON.stringify implementation, which injects the self-invoking function payload directly into the target code string.

Finally, when context.evalClosureSync executes the compiled template, the self-invoking payload breaks out of the wrapper environment, executing system commands on the underlying server outside the V8 sandbox.

The security impact of CVE-2026-86083 is classified as High, with a CVSS v4.0 base score of 7.7. Because successful exploitation results in full remote command execution, the confidentiality, integrity, and availability of the host operating system are fully compromised.

An attacker who achieves command execution can access all environment variables, local system configurations, and internal workflow databases. This data exposure compromises sensitive API tokens, database credentials, and service accounts utilized by the automation server.

Furthermore, the attacker can leverage the compromised host to perform lateral network reconnaissance, pivot to internal services, or establish persistence. The direct impact is limited to the system hosting the n8n application process, but the downstream compromise of connected infrastructure can be extensive.

To resolve the vulnerability, administrators must either upgrade to a patched version or change the expression engine configuration.

The primary mitigation is upgrading n8n to one of the following official secure releases:

• 1.123.76
• 2.37.7
• 2.38.2 or higher.

If upgrading is not immediately possible, administrators can mitigate the vulnerability by disabling the legacy expression engine. Setting the following environment variable forces n8n to utilize the hardened V8 expression engine, which does not rely on mutable code-generation paths:

N8N_EXPRESSION_ENGINE=vm

Additionally, ensure the n8n process runs within a highly isolated environment, such as a dedicated, non-root Docker container, to minimize the impact of any potential sandbox escape.