n8n Sandbox Escape Lets Workflow Editors Run OS Commands as the n8n Process

n8n has patched a high-severity expression-sandbox escape that could let an authenticated workflow editor execute operating-system commands on the server running the automation platform. Security Joes found the flaw while probing n8n's February fix for CVE-2026-27577 for another bypass. The affected ranges are =2.32.0,<2.32.1. n8n fixed the flaw in versions 2.31.5 and

The article reports a high-severity expression sandbox escape in n8n that lets any authenticated workflow editor execute operating-system commands as the n8n process on affected versions, with fixes released in 2.31.5 and 2.32.1.[6][11] Exploitation requires an account with workflow creation or modification permissions, but in typical deployments n8n often holds broadly scoped credentials and has network access to sensitive internal systems, so a compromised workflow editor account can pivot into wider infrastructure.[6][1] From a RealGround perspective, this is a SaaS AI risk because n8n commonly orchestrates AI agents and stores API keys and OAuth tokens; insecure sandboxing means workflow logic can be abused to run arbitrary OS commands, steal secrets, and tamper with AI automations. Practically, organizations should urgently patch affected n8n versions, harden deployment and permissions, and include n8n in AI supply-chain SBOM and continuous red-teaming to detect malicious workflows and sandbox-bypass patterns.