« Volver al listado

CVE-2026-77083

Estado: AnalizadaMedia (6)—

n8n is a workflow automation platform. In versions prior to 1.123.69, 2.33.4, and 2.34.1, the JavaScript Code node's VM sandbox did not freeze the sandbox's Function.prototype, allowing an authenticated user with the ability to create and execute workflows to pollute it from within a Code node execution and recover a reference to the host's globalThis, resulting in a sandbox escape. The full exploit chain additionally depends on specific modules being available as allowlisted imports in the deployment's configuration. The issue is fixed in versions 1.123.69, 2.33.4, and 2.34.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

N8N — N8N

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-77083",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-77083",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-08-20T14:53:30.185711Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 1.6
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "disclosure@vulncheck.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 6,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "disclosure@vulncheck.com",
      "affectedData": [
        {
          "vendor": "n8n-io",
          "product": "n8n",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.123.69",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.123.69",
              "versionType": "semver"
            }
          ],
          "packageURL": "pkg:npm/n8n",
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "n8n-io",
          "product": "n8n",
          "versions": [
            {
              "status": "affected",
              "version": "2.34.0",
              "lessThan": "2.34.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.34.1",
              "versionType": "semver"
            }
          ],
          "packageURL": "pkg:npm/n8n",
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "n8n-io",
          "product": "n8n",
          "versions": [
            {
              "status": "affected",
              "version": "2.0.0",
              "lessThan": "2.33.4",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.33.4",
              "versionType": "semver"
            }
          ],
          "packageURL": "pkg:npm/n8n",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-08-20T12:16:39.840",
  "references": [
    {
      "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-c9c6-rq46-h25v",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://www.vulncheck.com/advisories/n8n-before-code-node-sandbox-escape-via-function.prototype-pollution",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "disclosure@vulncheck.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "disclosure@vulncheck.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1321"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "n8n is a workflow automation platform. In versions prior to 1.123.69, 2.33.4, and 2.34.1, the JavaScript Code node's VM sandbox did not freeze the sandbox's Function.prototype, allowing an authenticated user with the ability to create and execute workflows to pollute it from within a Code node execution and recover a reference to the host's globalThis, resulting in a sandbox escape. The full exploit chain additionally depends on specific modules being available as allowlisted imports in the deployment's configuration. The issue is fixed in versions 1.123.69, 2.33.4, and 2.34.1."
    }
  ],
  "lastModified": "2026-09-01T19:49:07.397",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2FDA665B-3F86-4C01-A62B-E18E0B5F47C1",
              "versionEndExcluding": "1.123.69"
            },
            {
              "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9D61014E-3ABC-4881-A3EB-FE35C498E202",
              "versionEndExcluding": "2.33.4",
              "versionStartIncluding": "2.0.0"
            },
            {
              "criteria": "cpe:2.3:a:n8n:n8n:2.34.0:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8A0C7105-5801-41C3-89AA-40C2D938ECCD"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "disclosure@vulncheck.com"
}