{"id":"CVE-2026-85165","title":"n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, or class-extension positions resolve against process globals","summary":"n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, or class-extension positions resolve against process globals. Authenticated users with workflow-ed…","severity":"critical","cvss":9.9,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":["CWE-95"],"vendor":"n8n","product":"n8n","affected":["n8n < 2.35.4","n8n >= 2.36.0, <= 2.36.2"],"patched":["n8n 2.35.4"],"published":"2026-09-03","updated":"2026-09-10","sourceUpdated":"2026-09-10T19:55:37.867","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85165","references":[{"url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-fg85-4wv2-p98j","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/n8n-before-2.36.2-expression-sandbox-bypass-via-spreadelement","label":"disclosure@vulncheck.com"}],"tags":["nvd"],"epss":0.00315,"epssPercentile":0.24518,"ingestedAt":"2026-09-08T21:11:12.290Z","slug":"CVE-2026-85165","body":"## Overview\n\nn8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, or class-extension positions resolve against process globals. Authenticated users with workflow-edit permission can mutate host objects through expression evaluation, with changes persisting process-wide until restart.\n\n## Affected\n\n- `n8n < 2.35.4`\n- `n8n >= 2.36.0, <= 2.36.2`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `n8n 2.35.4`","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":54.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":202023,"id":"CVE-2026-85165","ts":1789400045480,"field":"cvss","old":null,"new":"9.9"},{"seq":202022,"id":"CVE-2026-85165","ts":1789400045480,"field":"severity","old":"none","new":"critical"},{"seq":200750,"id":"CVE-2026-85165","ts":1789397604219,"field":"cvss","old":"9.9","new":null},{"seq":200749,"id":"CVE-2026-85165","ts":1789397604219,"field":"severity","old":"critical","new":"none"},{"seq":199445,"id":"CVE-2026-85165","ts":1789395513400,"field":"cvss","old":null,"new":"9.9"},{"seq":199444,"id":"CVE-2026-85165","ts":1789395513400,"field":"severity","old":"none","new":"critical"},{"seq":198690,"id":"CVE-2026-85165","ts":1789392229555,"field":"cvss","old":"9.9","new":null},{"seq":198689,"id":"CVE-2026-85165","ts":1789392229555,"field":"severity","old":"critical","new":"none"},{"seq":197023,"id":"CVE-2026-85165","ts":1789384290234,"field":"cvss","old":null,"new":"9.9"},{"seq":197022,"id":"CVE-2026-85165","ts":1789384290234,"field":"severity","old":"none","new":"critical"},{"seq":194152,"id":"CVE-2026-85165","ts":1789378768431,"field":"cvss","old":"9.9","new":null},{"seq":194151,"id":"CVE-2026-85165","ts":1789378768431,"field":"severity","old":"critical","new":"none"},{"seq":192939,"id":"CVE-2026-85165","ts":1789376512806,"field":"cvss","old":null,"new":"9.9"},{"seq":192938,"id":"CVE-2026-85165","ts":1789376512806,"field":"severity","old":"none","new":"critical"},{"seq":191726,"id":"CVE-2026-85165","ts":1789373617800,"field":"cvss","old":"9.9","new":null},{"seq":191725,"id":"CVE-2026-85165","ts":1789373617800,"field":"severity","old":"critical","new":"none"},{"seq":190511,"id":"CVE-2026-85165","ts":1789369469392,"field":"cvss","old":null,"new":"9.9"},{"seq":190510,"id":"CVE-2026-85165","ts":1789369469392,"field":"severity","old":"none","new":"critical"},{"seq":189298,"id":"CVE-2026-85165","ts":1789368395605,"field":"cvss","old":"9.9","new":null},{"seq":189297,"id":"CVE-2026-85165","ts":1789368395605,"field":"severity","old":"critical","new":"none"},{"seq":188081,"id":"CVE-2026-85165","ts":1789365228094,"field":"cvss","old":null,"new":"9.9"},{"seq":188080,"id":"CVE-2026-85165","ts":1789365228094,"field":"severity","old":"none","new":"critical"},{"seq":186868,"id":"CVE-2026-85165","ts":1789363467226,"field":"cvss","old":"9.9","new":null},{"seq":186867,"id":"CVE-2026-85165","ts":1789363467226,"field":"severity","old":"critical","new":"none"},{"seq":185654,"id":"CVE-2026-85165","ts":1789361222840,"field":"cvss","old":null,"new":"9.9"},{"seq":185653,"id":"CVE-2026-85165","ts":1789361222840,"field":"severity","old":"none","new":"critical"},{"seq":184441,"id":"CVE-2026-85165","ts":1789358349810,"field":"cvss","old":"9.9","new":null},{"seq":184440,"id":"CVE-2026-85165","ts":1789358349810,"field":"severity","old":"critical","new":"none"},{"seq":182692,"id":"CVE-2026-85165","ts":1789354314080,"field":"cvss","old":null,"new":"9.9"},{"seq":182691,"id":"CVE-2026-85165","ts":1789354314080,"field":"severity","old":"none","new":"critical"},{"seq":181485,"id":"CVE-2026-85165","ts":1789353311973,"field":"cvss","old":"9.9","new":null},{"seq":181484,"id":"CVE-2026-85165","ts":1789353311973,"field":"severity","old":"critical","new":"none"},{"seq":180278,"id":"CVE-2026-85165","ts":1789350276246,"field":"cvss","old":null,"new":"9.9"},{"seq":180277,"id":"CVE-2026-85165","ts":1789350276246,"field":"severity","old":"none","new":"critical"},{"seq":179071,"id":"CVE-2026-85165","ts":1789348277213,"field":"cvss","old":"9.9","new":null},{"seq":179070,"id":"CVE-2026-85165","ts":1789348277213,"field":"severity","old":"critical","new":"none"},{"seq":177864,"id":"CVE-2026-85165","ts":1789346365885,"field":"cvss","old":null,"new":"9.9"},{"seq":177863,"id":"CVE-2026-85165","ts":1789346365885,"field":"severity","old":"none","new":"critical"},{"seq":176657,"id":"CVE-2026-85165","ts":1789343172188,"field":"cvss","old":"9.9","new":null},{"seq":176656,"id":"CVE-2026-85165","ts":1789343172188,"field":"severity","old":"critical","new":"none"},{"seq":174774,"id":"CVE-2026-85165","ts":1789334873025,"field":"cvss","old":null,"new":"9.9"},{"seq":174773,"id":"CVE-2026-85165","ts":1789334873025,"field":"severity","old":"none","new":"critical"},{"seq":173569,"id":"CVE-2026-85165","ts":1789333684811,"field":"cvss","old":"9.9","new":null},{"seq":173568,"id":"CVE-2026-85165","ts":1789333684811,"field":"severity","old":"critical","new":"none"},{"seq":172383,"id":"CVE-2026-85165","ts":1789331089896,"field":"cvss","old":null,"new":"9.9"},{"seq":172382,"id":"CVE-2026-85165","ts":1789331089896,"field":"severity","old":"none","new":"critical"},{"seq":171197,"id":"CVE-2026-85165","ts":1789328768587,"field":"cvss","old":"9.9","new":null},{"seq":171196,"id":"CVE-2026-85165","ts":1789328768587,"field":"severity","old":"critical","new":"none"},{"seq":169992,"id":"CVE-2026-85165","ts":1789327184841,"field":"cvss","old":null,"new":"9.9"},{"seq":169991,"id":"CVE-2026-85165","ts":1789327184841,"field":"severity","old":"none","new":"critical"}]}