GHSA-hx4h-vr3m-45vh: n8n: Prototype Pollution via VM Expression Engine Sandbox Escape Leads to Denial of Service

n8n evaluates workflow expressions, the {{ ... }} snippets, in a VM-based expression engine that is meant to keep expression code away from the host. The engine's handling of array-element access let an expression obtain a reference to a host built-in. Writing to that object's prototype changes behavior for every piece of code in the main n8n process, since they share the same built-ins.

The advisory names denial of service as the result. A polluted prototype can make the main process throw errors or misbehave on ordinary operations, which takes the whole instance down for all users, not just the attacker's workflows. The CVSS 4.0 vector reflects that: no confidentiality impact, high integrity and availability impact on the n8n system.

The attacker needs a low-privilege account that can create or edit a workflow expression. Instances that give workflow editing to many members, or to customers, are the most exposed. Because the pollution lives in the main process, restarting n8n clears it, but the attacker can repeat it. The advisory does not claim code execution.

The npm package n8n below 1.123.67 on the 1.x line, >= 2.0.0-rc.0, < 2.31.5, and 2.32.0. Self-hosted and cloud instances that run the VM expression engine are affected.

npm ls n8n

For Docker, check the image tag. The attacker must be able to create or edit workflow expressions.

Upgrade n8n to 1.123.67, 2.31.5 or 2.32.1, or later, matching your release line.

Temporary measures from the advisory, which it says do not fully remove the risk:

• Limit instance access to fully trusted users.
• Turn off the VM expression engine, if your deployment offers an alternative.

The advisory gives no setting name for the second item, so check the n8n documentation for your version.

The advisory gives no log signature. Watch for repeated crashes, restarts or unexplained errors in the main n8n process that start soon after a user saves or runs a workflow. Check the n8n logs for exceptions at expression evaluation, and review recently edited workflows for expressions that index into arrays and then touch constructor, __proto__ or prototype.

Audit which accounts can edit workflows, and who changed a workflow shortly before each outage.

Impact

An authenticated user able to create or edit a workflow expression could abuse the expression engine's array-element access to obtain a reference to a host built-in and pollute its prototype in the main n8n process, leading to a denial of service.

Both self-hosted and cloud instances running the VM expression engine are affected.

Patches

The issue has been fixed in n8n versions 1.123.67, 2.31.5, and 2.32.1. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

• Restrict n8n instance access to fully trusted users only.
• Disable the VM expression engine if an alternative is available for your deployment.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.