Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: n8n automation platform users
Incident: A high-severity sandbox escape vulnerability allowing OS command execution.
Impact: Full server compromise, credential decryption, and unauthorized access to connected internal services.
Attacker: Authenticated users with workflow editing permissions
Analysis: The vulnerability stems from an oversight in the abstract syntax tree (AST) rewriter and property check mechanisms. By leveraging specific arrow function expressions and Reflect.get(), attackers can bypass the sandbox to access the Node.js global process object. This chain allows for full operating system command execution with the privileges of the n8n process.
Recommendations: Update n8n instances to version 2.31.5 or 2.32.1 immediately.; Restrict workflow editing permissions to a minimal set of highly trusted users.; Rotate the N8N_ENCRYPTION_KEY if unauthorized access to workflow editing is suspected.
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source