🚨High - n8n Expression Sandbox Escape via __sanitize Class Field (CVE-2026-86076) n8n’s PrototypeSanitizer hook in packages/workflow/src/expression-sandboxing.ts binds the expression compiler sanitizer via dynamically scoped this and fails to block reserved class member names. Defining a class field named __sanitize can rebind the sanitizer and reach the Function constructor, yielding backend RCE and JS execution in editor preview when a user opens the workflow. 👉Affected: n8n < 1.123.76, 2.37.x < 2.37.7, 2.38.x < 2.38.2 | Upgrade to 1.123.76 / 2.37.7 / 2.38.2
Post summary
The release discloses a high‑severity n8n prototype sanitization flaw that allows RCE via a __sanitize class field, recommending users upgrade to versions 1.123.76, 2.37.7, or 2.38.2.