n8n versions before 2.36.2 allow an expression sandbox bypass where free identifiers used in spread elements, computed keys, switches, or class extensions are resolved against process globals. Authenticated users with workflow‑edit permission can evaluate malicious expressions that mutate host objects, and those changes persist across the entire process until a restart. This flaw enables an attacker to alter the server’s runtime environment, potentially injecting code or enabling further exploitation. The underlying weakness is identified as CWE‑95, improper neutralization of elements used in a command or interface.

All n8n instances from the n8n‑io project that are running a version older than 2.36.2 are affected. The vulnerability applies to the n8n workflow automation platform and any deployment using the default expression sandbox.

The CVSS score of 7.2 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited evidence of exploitation in the wild. However, the attack requires authenticated access with workflow‑edit rights; once obtained, the attacker can alter process‑wide state by crafting a workflow containing the vulnerable expressions. The lack of a publicly available exploitation script or reported incidents does not reduce the need for caution, as the persistence of changes could lead to persistent compromise of the host environment. The risk is elevated for environments where users with workflow‑edit rights are not tightly controlled or monitored.