Description
n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, or class-extension positions resolve against process globals. Authenticated users with workflow-edit permission can mutate host objects through expression evaluation, with changes persisting process-wide until restart.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n8n-io n8n
Default version status: unaffected
2.36.0 to < 2.36.2affected2.36.2unaffected
pkg:npm/n8nn8n-io n8n
Default version status: unaffected
0 to < 2.35.4affected2.35.4unaffected
pkg:npm/n8n