EUVD-2026-70400: expression sandbox bypass in n8n before 2.36.2

Summary

The EUVD entry, scored 7.2 under CVSS v3.1, describes an expression sandbox bypass in n8n versions before 2.36.2. The entry says authenticated users with workflow permissions can reach process globals through certain expression constructs.

If you use n8n

Upgrade n8n to 2.36.2 or later

Limit workflow creation and editing to trusted users

Review existing workflows for unexpected expressions

Upgrade n8n to 2.35.4 or 2.36.2 or later, depending on your branch

Review who can create or edit workflows that run inline sub-workflows

Audit credentials that shared-workflow editors can reference

What the sources say 13

Oct 29, 2026, 9:04 PM UTC · Mastodon: “In n8n versions before 1.123.76, 2.37.7, and 2.38.2, the source control push endpoint derived the set of files to push from the file paths and status supplied in the client request payload” Source

Oct 29, 2026, 9:04 PM UTC · Mastodon: “In versions before 1.123.76, 2.37.7, and 2.38.2, the Git node validated a relative remote URL against the configured repositoryPath but then invoked git with that path as its working directo” Source

Oct 29, 2026, 9:05 PM UTC · Mastodon: “n8n versions before 2.36.2 contain a missing per-project authorization vulnerability in the Insights API routes that allows authenticated users with insights scopes to access workflow names and execution statistics across projects.” Source

Oct 29, 2026, 9:05 PM UTC · Mastodon: “n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and Function nodes.” Source

Oct 29, 2026, 9:05 PM UTC · Mastodon: “n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes.” Source

Oct 29, 2026, 9:05 PM UTC · Mastodon: “n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gmail (v1) and Brevo nodes to the mail composer without verifying it is a string.” Source

Oct 29, 2026, 9:05 PM UTC · Mastodon: “n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain an expression sandbox escape in the $fromAI handler.” Source

Oct 29, 2026, 9:05 PM UTC · Mastodon: “n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in the Git node.” Source

Oct 29, 2026, 9:05 PM UTC · Mastodon: “n8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerability in the Elasticsearch Document Get All and Google Cloud Firestore Document Query operations, which build their JSON query by interpolating expression va” Source

Oct 29, 2026, 9:05 PM UTC · Mastodon: “n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow (e.g., the Workflow Tool node).” Source

Oct 29, 2026, 9:06 PM UTC · Mastodon: “n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, or class-extension positions resolve against process globals.” Source

Oct 30, 2026, 12:03 PM UTC · Mastodon: “n8n from 2.14.0 through 2.46.3 contains a path traversal vulnerability in the Databricks node that allows unauthenticated attackers to reach arbitrary Databricks API endpoints by injecting unencoded resource identifiers.” Source

Oct 30, 2026, 12:06 PM UTC · Mastodon: “n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability via deprecated Function, Function Item, and LangChain Code nodes running outside task runner isolation.” Source