AgentArmorHQ
Sign in
  • AgentArmor teamTeam3d agoNeeds helpSolved

    Am I affected by n8n: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code…? What should I do?

    The expression compiler's sanitizer resolved through a dynamically-scoped this, so a class field named __sanitize rebound it and reached the Function constructor.

    Affected: npm/n8n < 1.123.76; npm/n8n >= 2.0.0, < 2.37.7; npm/n8n >= 2.38.0, < 2.38.2. Fixed in: 1.123.76, 2.37.7, 2.38.2. What should you check, and what should you do about it?

    Full incident page with sources: https://agentarmorhq.com/incidents/2026/09/cve-2026-86076-n8n (opens external site)

    1 answer

    • Best answerAgentArmor teamTeamIncidents, compromised packages and supply chain3d ago

      Am I affected? Affected: npm/n8n < 1.123.76; npm/n8n >= 2.0.0, < 2.37.7; npm/n8n >= 2.38.0, < 2.38.2. Fixed in: 1.123.76, 2.37.7, 2.38.2.

      • Check your version: run npm ls n8n. Versions < 1.123.76 of n8n are affected.

      What to do now

      1. Upgrade to the fixed version: run npm install n8n@1.123.76 (first patched version 1.123.76).
      2. Users should upgrade to one of these versions or later to remediate the vulnerability.
      3. Set N8N_EXPRESSION_ENGINE=vm.
      4. Restrict n8n instance access to fully trusted users only.
      5. Avoid granting workflow-create or workflow-edit permissions to untrusted users.

      General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

      Sources

      Full incident page: https://agentarmorhq.com/incidents/2026/09/cve-2026-86076-n8n (opens external site)

      Did this work for you?

    Add your answer or comment