VULNERABILITY INTELLIGENCE

CVE-2026-85165

CVSS score9.9 CRITICAL
EPSS probability0.57%
CISA KEVNot currently listed
Published2026-09-03
Last modified2026-10-29
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Description

n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, or class-extension positions resolve against process globals. Authenticated users with workflow-edit permission can mutate host objects through expression evaluation, with changes persisting process-wide until restart.

Weakness classification

  • disclosure@vulncheck.com: CWE-95

Primary references