SEPTEMBER 11, 2026
Live Feed
Back to database
Case File

CVE-2026-86083

HIGH · CVSS 8.8 EPSS 0.28% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-08 · Last synced 2026-09-11

CyberRota Analysis

AI-Generated

The legacy expression engine in n8n versions prior to 1.123.76, 2.37.7, and 2.38.2 is vulnerable to code injection due to the use of a mutable global JSON.stringify, allowing attackers to execute arbitrary code through crafted expressions. Organizations utilizing n8n for workflow automation should prioritize upgrading to the patched versions to mitigate the risk of exploitation and potential compromise of their systems.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-86083
Severity
HIGH
CVSS
8.8
EPSS
0.28%

Original NVD Description

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the legacy expression engine generated source text by calling the mutable global JSON.stringify while printing synthetic string literals and interpolating timezone data. An expression could replace JSON.stringify and cause later generated source to contain executable attacker-controlled code. The affected code-generation paths include packages/@n8n/expression-runtime/src/bridge/isolated-vm-bridge.ts and packages/@n8n/tournament/src/ExpressionBuilder.ts, and the issue does not affect the vm expression engine. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.

Related CVEs

Other vulnerabilities affecting the same vendor(s)