CVE-2026-85165

n8n versions before 2.36.2 contain an expression sandbox bypass. Free identifiers in spread, computed-key, switch-case, or class-extension positions resolve against process globals instead of remaining sandboxed. Authenticated users with workflow-edit permission can mutate host objects through ex...