LOWVulnerability
Global

n8n Sandbox Escape Lets Workflow Editors Run OS Commands as the n8n Process

·Source: The Hacker News

Updated:

Executive Summary

n8n has patched a high-severity expression-sandbox escape that could let an authenticated workflow editor execute operating-system commands on the server running the automation platform. Security Joes found the flaw while probing n8n's February fix for CVE-2026-27577 for another bypass. The affected ranges are =2.32.0,<2.32.1. n8n fixed the flaw in versions 2.31.5 and

Analysis

n8n has patched a high-severity expression-sandbox escape that could let an authenticated workflow editor execute operating-system commands on the server running the automation platform. Security Joes found the flaw while probing n8n's February fix for CVE-2026-27577 for another bypass. The affected ranges are =2.32.0,<2.32.1. n8n fixed the flaw in versions 2.31.5 and

Indicators of Compromise (1)

CVE (1)
CVE-2026-27577
NVDMITRE CVE
Source Attribution

Originally published by The Hacker News on Jul 27, 2026.

Related Threats

CRITICALVulnerabilityNEW

Unpatched Fastjson Vulnerability Exploited in Attacks

The critical remote code execution bug can be exploited without authentication, under the library’s stock default configurations. The post Unpatched Fastjson Vulnerability Exploited in Attacks appeared first on SecurityWeek .

SecurityWeek
HIGHVulnerabilityNEW

NVD HIGH: CVE-2026-16585 — The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots pl...

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_sticker function in all versions up to, and including, 2.15.19. This makes it possible for authenticated attackers, with administrator-level access and above, to delete arbitrary files on the server, which

CVE-2026-16585
NIST NVD
HIGHVulnerabilityNEW

NVD HIGH: CVE-2026-14490 — The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPres...

The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 0.0.7. The vulnerability exists because the plugin stores its HMAC signing key and per-step restore token as dotfiles inside a publicly accessible subdirectory of the WordPress uploads folder — without any `.htaccess` or index file pr

CVE-2026-14490
NIST NVD