{"data":{"id":"bdd7670e-1015-4e34-adaf-d3734f157839","title":"GHSA-gv7g-jm28-cr3m: n8n: Expression sandbox escape via arrow-function bodies enabling command execution","summary":"GHSA-gv7g-jm28-cr3m affects n8n. An authenticated user with permission to create or modify workflows can craft expressions using arrow functions that bypass the expression sandbox. This triggers unintended system command execution on the host running n8n.","solution":"Fixed in n8n versions 2.31.5 and 2.32.1. Upgrade to one of these versions or later. If upgrading is not immediately possible, restrict n8n instance access and workflow creation and editing permissions to fully trusted users only. These workarounds do not fully remediate the risk and should be used only as short-term measures.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-gv7g-jm28-cr3m","publishedAt":"2026-07-22T22:10:15.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["n8n@< 2.31.5 (fixed: 2.31.5)","n8n@>= 2.32.0, < 2.32.1 (fixed: 2.32.1)"],"affectedPackageNames":["n8n"],"affectedPackageRefs":["npm:n8n"],"affectedVendors":[],"affectedVendorsRaw":["n8n"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-gv7g-jm28-cr3m"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-07-22T22:10:15.000Z","fixReleasedAt":"2026-07-22T10:18:23.590Z","daysToFix":0,"fixCheckedAt":"2026-10-29T21:32:51.845Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.7,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"n8n","fixedVersion":"2.32.1","matchedVersion":"2.32.1","fixReleasedAt":"2026-07-22T10:18:23.590Z","daysToFix":0,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:32:51.698Z"},{"ecosystem":"npm","name":"n8n","fixedVersion":"2.31.5","matchedVersion":"2.31.5","fixReleasedAt":"2026-07-22T10:24:16.316Z","daysToFix":0,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:32:51.698Z"}]}}