CVE-2026-86083

n8n versions before 1.123.76, 2.37.7, and 2.38.2 contain a code injection flaw (CWE-94) in the legacy expression engine, which builds executable source text by calling the mutable global JSON.stringify when printing synthetic string literals and interpolating timezone data. An expression evaluated by this engine can replace JSON.stringify, causing later generated source to contain executable attacker-controlled code that runs during expression evaluation. An attacker with low privileges, such as a user who can create or edit workflows or who can influence expression inputs over the network, can gain code execution with high impact on confidentiality, integrity, and availability (CVSS 4.0: 7.7 High). Only instances that evaluate expressions with the legacy engine are affected; the vm expression engine is not. There is no known public proof-of-concept, no known in-the-wild exploitation, and EPSS is low (0.3%, not in CISA KEV), so current exploitation risk is low.

What to do: Upgrade n8n to 1.123.76 on the 1.x line, or to 2.37.7 or 2.38.2 on the 2.x line. Until patched, restrict workflow creation and editing to trusted users and audit existing workflows for expressions that redefine or override JSON.stringify. Operators whose instances use the vm expression engine rather than the legacy engine are not affected by this flaw.