Loading vulnerability…
CVE-2026-27495 is a critical sandbox escape vulnerability in n8n affecting versions prior to 2.10.1, 2.9.3, and 1.123.22. An authenticated user who has permission to create or modify workflows can exploit a code injection flaw in the JavaScript Task Runner sandbox to execute arbitrary code outside the intended sandbox boundary. The issue affects deployments where Task Runners are enabled. In the default internal Task Runner mode, successful exploitation can break isolation between workflow-executed JavaScript and the underlying host environment, enabling execution on the system running n8n. In external Task Runner mode, exploitation can still impact the runner environment and other tasks executed there, although the blast radius is reduced compared with the default internal mode.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a compact Python proof-of-concept exploit for CVE-2026-27495, a sandbox escape in n8n's JavaScript Task Runner / Code node execution environment. The repo contains three files: a README with usage and affected versions, a docker-compose lab that deploys n8n 2.10.0 in a vulnerable configuration, and the main exploit script exploit.py. The exploit is not tied to a public exploitation framework. It uses Python requests to interact directly with n8n's REST API. Operational flow: optionally create the initial owner account on fresh instances, authenticate, create a workflow with a Manual Trigger node and a malicious Code node, execute the workflow, poll for execution results, print either probe findings or command output, and finally delete the workflow for cleanup. Two JavaScript payload modes are embedded in the script. The probe payload demonstrates sandbox escape by accessing host-realm constructors via module.constructor, checking whether leaked host objects/functions/errors are frozen, and collecting stack-trace-related host frame information. The RCE payload builds on the same escape primitive and attempts require('child_process').execSync(...) to run an attacker-supplied shell command, returning stdout in the workflow JSON result. If require is blocked, the script reports that full RCE is unavailable and suggests enabling NODE_FUNCTION_ALLOW_BUILTIN=* in the lab. Primary attack vector is web/API abuse against an authenticated n8n instance with Task Runners enabled. The exploit targets n8n versions listed in the README: <1.123.22, 2.0.0-2.9.2, and 2.10.0. It is more than a detector because it can achieve arbitrary command execution when the target configuration permits module access, but it remains a standalone PoC rather than a weaponized framework module.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A code injection vulnerability in n8n's JavaScript Task Runner sandbox that allows an authenticated user with workflow creation or modification permissions to execute arbitrary code outside the sandbox boundary.
A critical n8n vulnerability that enables sandbox escape and, in default configurations, can lead to full compromise of the underlying host.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.