CVE-2026-77083 n8n before 1.123.69 Code Node Sandbox Escape via Function.prototype Pollution

n8n is a workflow automation platform. In versions prior to 1.123.69, 2.33.4, and 2.34.1, the JavaScript Code node's VM sandbox did not freeze the sandbox's Function.prototype, allowing an authenticated user with the ability to create and execute workflows to pollute it from within a Code node...

CVE-2026-77083 n8n before 1.123.69 Code Node Sandbox Escape via Function.prototype Pollution

n8n is a workflow automation platform. In versions prior to 1.123.69, 2.33.4, and 2.34.1, the JavaScript Code node's VM sandbox did not freeze the sandbox's Function.prototype, allowing an authenticated user with the ability to create and execute workflows to pollute it from within a Code node...

CVE-2026-77077 n8n before 1.123.69 Remote Code Execution via EventEmitter Prototype Pollution

n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis functions but not internal module constructors such as EventEmitter, allowing an authenticated user with Code node access to exploit...

EUVD-2026-63266

n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis functions but not internal module constructors such as EventEmitter, allowing an authenticated user with Code node access to exploit...

CVE-2026-77077 n8n before 1.123.69 Remote Code Execution via EventEmitter Prototype Pollution

n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis functions but not internal module constructors such as EventEmitter, allowing an authenticated user with Code node access to exploit...

CVE-2026-77077 n8n before 1.123.69 Remote Code Execution via EventEmitter Prototype Pollution

n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis functions but not internal module constructors such as EventEmitter, allowing an authenticated user with Code node access to exploit...

CVE-2026-77077

n8n versions before 1.123.69, 2.33.4, and 2.34.1 have a VM sandbox escape in the task runner: the prototype-freezing routine misses internal constructors like EventEmitter, allowing an authenticated user with Code node access to pollute prototypes and execute arbitrary commands. The corruption is...

Linux Distros Unpatched Vulnerability : CVE-2026-71130

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.14. Easily exploitable...

Linux Distros Unpatched Vulnerability : CVE-2026-71116

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.14. Difficult to explo...

Linux Distros Unpatched Vulnerability : CVE-2026-71113

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.14. Easily exploitable...

Linux Distros Unpatched Vulnerability : CVE-2026-71134

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.14. Easily exploitable...

Linux Distros Unpatched Vulnerability : CVE-2026-71136

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.14. Easily exploitable...

PT-2026-78938

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.69 n8n versions prior to 2.33.4 n8n versions prior to 2.34.1 Description An authenticated user with permissions to create and execute workflows can achieve a sandbox escape within the JavaScript Code node. This occu...

Linux Distros Unpatched Vulnerability : CVE-2026-71135

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.14. Easily exploitable...

Linux Distros Unpatched Vulnerability : CVE-2026-71151

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.14. Difficult to explo...

Linux Distros Unpatched Vulnerability : CVE-2026-71129

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.14. Easily exploitable...

Linux Distros Unpatched Vulnerability : CVE-2026-71126

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.14. Difficult to explo...

Linux Distros Unpatched Vulnerability : CVE-2026-71128

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.14. Easily exploitable...

Linux Distros Unpatched Vulnerability : CVE-2026-71115

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.14. Easily exploitable...

Linux Distros Unpatched Vulnerability : CVE-2026-71131

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.14. Easily exploitable...