Vulnerability · Published Aug 20, 2026 · Assigned by VulnCheck

CVE-2026-77077n8n before 1.123.69 Remote Code Execution via EventEmitter Prototype Pollution

High 7.2

In plain English

A high-severity code injection in n8n from n8n-io. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 4.0)7.2High

Exploit odds (30 days)0.6%top 53.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis functions but not internal module constructors such as EventEmitter, allowing an authenticated user with Code node access to exploit prototype pollution to execute arbitrary commands within the runner container. Because the polluted prototype is a process-wide object, the corruption persists across other tenants' Code node executions on the same shared runner. On v1.x instances without task runners enabled, Code node JavaScript runs directly in the main n8n process, where the impact could be higher.

Affected products (as reported)

Vendor	Product	Versions
n8n-io	n8n	0 – before 1.123.69
n8n-io	n8n	2.34.0 – before 2.34.1
n8n-io	n8n	2.0.0 – before 2.33.4

Weakness: CWE-94 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

References

GitHub Security Advisory (GHSA-m3hg-p5r9-fg9h) vendor-advisory
VulnCheck Advisory: n8n before 1.123.69 Remote Code Execution via EventEmitter Prototype Pollution third-party-advisory