n8n patches a 17-CVE batch led by an expression-sandbox escape to backend code execution

What happened

The headline flaw, CVE-2026-86076: the expression compiler's sanitizer resolved through dynamically scoped this, so a class field named __sanitize rebinds the sanitizer and reaches the Function constructor, giving any expression author code execution in the n8n process, scored CVSS 3.1 8.8. A related legacy-engine flaw, CVE-2026-86083, reaches the same outcome and carries the same score. CVE-2026-86082 is the AI-specific entry: the OpenAI Chat Model node enforced the credential allowed-domain check on normal calls and skipped it on the model-search dropdown, so a workflow editor could point the dropdown at their own host and collect the stored OpenAI API key, scored 6.5. All are fixed in 1.123.76, 2.37.7 and 2.38.2.

Part of a batch of 17 CVE records n8n published on 8 September. Until updated, n8n advises restricting workflow edit permissions, auditing expressions and setting N8N_EXPRESSION_ENGINE=vm against the sandbox flaw.