---
id: GHSA-9cmh-xcqm-5hqr
title: 'n8n: Cross-Tenant Module-Cache Poisoning in the JS Task Runner'
summary: 'n8n: Cross-Tenant Module-Cache Poisoning in the JS Task Runner'
severity: medium
cwe:
  - CWE-20
vendor: n8n
product: n8n
ecosystem: npm
affected:
  - n8n < 1.123.67
  - 'n8n >= 2.32.0, < 2.32.1'
  - 'n8n >= 2.0.0-rc.0, < 2.31.5'
patched:
  - n8n 1.123.67
  - n8n 2.32.1
  - n8n 2.31.5
published: '2026-07-22'
updated: '2026-07-22'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-9cmh-xcqm-5hqr'
references:
  - url: 'https://github.com/n8n-io/n8n/security/advisories/GHSA-9cmh-xcqm-5hqr'
  - url: 'https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.67'
  - url: 'https://github.com/n8n-io/n8n/releases/tag/n8n@2.31.5'
  - url: 'https://github.com/n8n-io/n8n/releases/tag/n8n@2.32.1'
  - url: 'https://github.com/advisories/GHSA-9cmh-xcqm-5hqr'
tags:
  - ghsa
  - npm
ingestedAt: '2026-07-23T00:08:38.579Z'
---

## Overview

## Impact

n8n's JavaScript task runner shared one module cache across all users' Code-node executions, so a user able to run a Code node could poison a cached module and alter other users' Code-node executions on the same runner, affecting their confidentiality, integrity, or availability.

This is a cross-user isolation break within a single n8n instance. It does not constitute a sandbox escape or remote code execution. All multi-user n8n instances running the JS task runner with built-in or external modules enabled are affected.

## Patches

The issue has been fixed in n8n versions 1.123.67, 2.31.5, and 2.32.1. Users should upgrade to one of these versions or later to remediate the vulnerability.

## Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Restrict n8n instance access to fully trusted users only.
- Disable built-in and external module access in Code nodes by unsetting `NODE_FUNCTION_ALLOW_BUILTIN` and `NODE_FUNCTION_ALLOW_EXTERNAL`, which removes the poisonable module surface.
- Use the external runner mode with a dedicated runner per user or project if your deployment supports it.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

## Affected packages

- `n8n < 1.123.67`
- `n8n >= 2.32.0, < 2.32.1`
- `n8n >= 2.0.0-rc.0, < 2.31.5`

## Remediation

Upgrade to a patched release:

- `n8n 1.123.67`
- `n8n 2.32.1`
- `n8n 2.31.5`