n8n Sandbox Escape Lets Workflow Editors Run OS Commands as the n8n Process n8n 沙箱逃逸允许工作流编辑器以 n8n 进程身份运行操作系统命令

TL;DR

• An authenticated workflow editor in n8n can execute arbitrary operating-system commands on the server due to a high-severity expression-sandbox escape.
• The vulnerability was discovered by Security Joes while probing a previous fix for CVE-2026-27577, and it affects versions <2.31.5 and >=2.32.0,<2.32.1.
• The exploit relies on two conditions: an arrow-function gap in VariablePolyfill.ts and a bypass in property checks involving Reflect.get(), allowing access to Node.js globals like process.
• n8n patched the issue in versions 2.31.5 and 2.32.1 with a dedicated ArrowFunctionExpression handler and improved identifier rewriting, but interim mitigations (restricting access) are considered incomplete.
• Successful exploitation could expose N8N_ENCRYPTION_KEY, decrypt stored credentials, and provide lateral movement to connected databases, internal services, or cloud endpoints.

Why It Matters

This incident underscores the critical importance of rigorous sandboxing in automation platforms that allow user-defined expressions, especially when those expressions are executed with elevated privileges. For AI practitioners and security teams, it highlights how subtle implementation flaws—such as missing AST rewrites for concise arrow functions or inadequate property inspection—can lead to full remote code execution, even after prior fixes. The recurrence of similar escapes since 2025 suggests systemic challenges in securing expression evaluation layers, urging developers to adopt defense-in-depth strategies including comprehensive testing, least-privilege credential management, and continuous monitoring for anomalous process behavior.

Technical Details

• Vulnerability Scope: Affects n8n versions <2.31.5 and >=2.32.0,<2.32.1; patched in 2.31.5 and 2.32.1 under GHSA-gv7g-jm28-cr3m with CVSS 8.7 (High).
• Exploit Mechanism: Combines two flaws: (1) In version 2.31.4, VariablePolyfill.ts placed ArrowFunctionExpression in a no-op branch, allowing concise arrow bodies like () => process to resolve 'process' to the real Node.js global instead of the sandboxed context; (2) Property checks using Reflect.get() failed to intercept dynamic property access, enabling recovery of process.getBuiltinModule to load child_process and spawn OS commands.
• Prerequisites: Requires a valid account with workflow edit permissions; no user interaction needed beyond authentication. Execution occurs with the privileges of the n8n process.
• Impact: Full server compromise possible, including exposure of N8N_ENCRYPTION_KEY, decryption of stored credentials, and access to backend systems reachable from the n8n host.
• Fix Implementation: Updated abstract syntax tree rewriter now includes a dedicated ArrowFunctionExpression handler that routes bare identifiers in concise arrow bodies through the controlled data context, preventing leakage of Node.js globals.

Industry Insight

Organizations using n8n or similar workflow automation tools must prioritize immediate patching to vulnerable versions and conduct forensic reviews of recent workflows for obfuscated JavaScript or unexpected arrow functions. Given the history of repeated sandbox escapes in n8n, enterprises should enforce strict separation of duties—limiting workflow editing to highly trusted personnel—and implement runtime monitoring for suspicious child processes (e.g., shells, curl, wget) spawned by n8n or Node.js. Additionally, credential hygiene is paramount: rotate any potentially exposed secrets and consider isolating n8n instances with minimal network access to reduce blast radius in case of future vulnerabilities.

TL;DR

• n8n修复了一个高危表达式沙箱逃逸漏洞（GHSA-gv7g-jm28-cr3m，CVSS 8.7），允许经过身份验证的工作流编辑者在服务器上执行操作系统命令。
• 该漏洞由Security Joes在审查n8n对CVE-2026-27577的修复时发现，涉及两个独立缺陷的结合：抽象语法树重写器中的箭头函数处理不当以及Reflect.get()属性检查盲区。
• 受影响版本为<2.31.5和>=2.32.0,<2.32.1，修复版本为2.31.5和2.32.1；利用此漏洞可暴露加密密钥、解密凭证并访问后端数据库与云服务。
• 攻击需具备工作流创建或修改权限，无需用户交互，成功执行后将获得n8n进程同等权限，构成远程代码执行风险。
• 建议管理员立即升级而非仅依赖临时访问控制措施，并审查近期工作流中是否存在可疑箭头函数或混淆JavaScript代码。

为什么值得看

本文揭示了一个典型的“组合式”安全漏洞——单一组件缺陷不足以造成危害，但多个边界条件同时被突破时即可引发严重后果，这对自动化平台及低代码工具的安全设计具有重要警示意义。对于DevSecOps团队而言，它强调了持续集成测试中应覆盖边缘场景（如简写箭头函数、反射调用等），并提醒关注第三方库在表达式解析层级的潜在绕过路径。此外，该事件反映了当前AI驱动的开发辅助工具可能引入的新型攻击面，促使行业重新评估工作流引擎的信任模型与隔离机制。

技术解析

• 核心漏洞成因：n8n使用抽象语法树（AST）重写器将表达式中的自由标识符映射到受控数据上下文以隔离Node.js运行时环境。但在2.31.4版本中，VariablePolyfill.ts未正确处理ArrowFunctionExpression类型，导致简洁体形式的箭头函数（如() => process）直接解析为真实的process全局对象，从而绕过沙箱限制。
• 第二重突破口：即使第一个缺陷未被利用，攻击者仍可通过Reflect.get()函数绕过成员表达式的静态属性检查机制。由于该函数接收请求的属性名作为参数而非字面量，研究人员借此恢复出process.getBuiltinModule方法，进而加载child_process模块并在主机上执行任意命令。
• 验证方式与范围：Proof-of-Concept在n8n 2.30.4至2.32.0之间通过发布的工作流包和本地实例进行测试确认；对比公开源码发现2.31.5版本已添加专门的ArrowFunctionExpression处理器，确保简洁体内的裸标识符经数据上下文路由，但未完全复现Security Joes描述的完整Reflect.get()链。
• 评分依据：初始估计接近CVE-2026-27577的9.4分Critical等级，最终定为8.7 High，因其虽需认证且依赖特定构造，但一旦成功即实现从受限工作流编辑权限到服务器级控制的跃迁，影响面广且破坏力强。
• 缓解局限性：n8n建议的临时措施（如限制实例访问和仅限可信用户编辑工作流）被明确标注为不完整且短期有效，无法根本消除风险，因此强制更新是唯一可靠解决方案。

行业启示

• 低代码/无代码平台需强化表达式引擎的安全性审计：随着企业广泛采用可视化工具编排业务流程，其内置脚本解释器成为关键攻击面。厂商应在CI/CD管道中加入针对特殊语法结构（如隐式全局引用、动态属性访问）的模糊测试用例，防止类似沙箱逃逸问题累积。
• 纵深防御策略不可忽视最小权限原则部署：即便应用本身存在已知弱点，通过严格限制服务账户权限、网络分段存储敏感凭证等方式仍可大幅降低横向移动可能性。尤其当n8n类系统连接数据库或云API时，务必启用细粒度IAM策略并定期轮换密钥。
• 主动威胁狩猎应纳入常规运维流程：鉴于此类漏洞往往伴随隐蔽的后置操作（如spawn shell/curl/wget），组织需建立基于异常行为检测的监控体系，包括追踪非预期子进程生成、非常规文件写入及 outbound 连接模式，以便快速响应潜在入侵事件。