n8n Legacy Expression Engine Sandbox Escape via Global JSON.stringify Tampering

Technical Analysis

The vulnerability arises because two code-generation stages (the expression compiler's string-literal printer and the isolate bridge's timezone interpolation) call the global JSON.stringify at generation time rather than using a captured reference. An attacker who can supply an expression evaluated by the legacy engine can reassign JSON.stringify to a malicious function; subsequent code generation calls this tampered function, causing attacker-controlled output to be spliced into the generated source string as executable code rather than an escaped literal. This effectively turns a data-serialization step into a code-injection primitive, breaking the isolation boundary between the expression sandbox and the host JS runtime, granting the attacker command execution in the n8n process context. The fix captures a reference to JSON.stringify at module load time so later tampering with the global cannot affect code generation.

Affected Systems

n8n

Detection Signatures

• Workflow expressions that reassign or monkey-patch global built-ins such as JSON.stringify, Object.prototype methods, or Array.prototype methods
• Use of legacy expression engine (N8N_EXPRESSION_ENGINE not set to 'vm') in logs/config
• Unexpected process spawning or file system access originating from n8n Function/Expression nodes
• Workflow definitions containing prototype pollution or global override patterns e.g. 'JSON.stringify = ' inside expression fields
• Anomalous n8n worker process behavior following workflow execution from untrusted/low-privilege users

Remediation Steps

1. 1

   Upgrade n8n

   Update to n8n 1.123.76, 2.37.7, 2.38.2, or later, which capture code-generation references at module load to prevent global tampering from affecting generated source.

2. 2

   Switch to vm expression engine

   Set N8N_EXPRESSION_ENGINE=vm to use the unaffected engine if immediate upgrade is not possible.

3. 3

   Restrict workflow authoring access

   Limit who can create or edit workflows/expressions to fully trusted users, since exploitation requires the ability to submit expressions.

4. 4

   Run with least privilege

   Execute the n8n process under a dedicated low-privilege OS account to constrain the impact of any achieved code execution.

5. 5

   Audit existing workflows

   Review stored workflows for expressions that reassign global built-ins or otherwise attempt to tamper with runtime internals.