Disclosed vulnerability
n8n expression sandbox escape: template literals, arrow functions and Object.defineProperty defeat the AST sanitizer for full server takeover (CVE-2026-25049)
AIR-2026-0031 AIR record · 2026-02-n8n-expression-sandbox-escape
From the supporting source
The access we gained allowed us to execute arbitrary system commands on the n8n server [and] decrypt every stored credential in the database.pillar.security
The record
Disclosed
2026-02-04
Vendor
n8n
Product
n8n (self-hosted and Cloud)
Risk domain
Access control and permissions › Credential theft
Also touches
Privilege escalation
System type
Generative model
Who acted
AI was the target — an AST sanitizer bypass gives full server takeover
Attack surface
Agent framework
Autonomy level
Semi-autonomous
Initial vector
Authenticated workflow expression injection
Impact type
Remote code execution, Credential theft, Cross tenant exposure
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0012 – Valid Accounts
- NIST AI RMF
- MEASURE 2.7
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Use secure credential storage; Implement short-lived tokens.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
self-hosted and n8n Cloud instances; every credential stored in the instance
Capability abused
Defense & remediation
Recorded defense
AST-based expression sandbox restricting property access
Guardrail kinds
Sandbox isolation
Guardrail outcome
Silent
Fix shipped
n8n 2.4.0 (January 2026); first patch 2025-12-23 was incomplete and bypassed 2025-12-24
Taxonomy & references
Curator notes
Pillar Security (Eilon Cohen). Discovered 2025-12-21; incomplete patch 2025-12-23; Object.defineProperty bypass 2025-12-24; full fix in 2.4.0; coordinated disclosure 2026-02-04. CVSS 10.0. Extracting N8N_ENCRYPTION_KEY turns one workflow author into full credential-vault compromise. Distinct from CVE-2025-68613 (2025-12-n8n-expression-injection-rce) and the Rapid7 Ni8mare/N8scape pair (2026-01-n8n-ni8mare-n8scape-cluster).
Supporting sources
Cite as
Enkrypt AI. "n8n expression sandbox escape: template literals, arrow functions and Object.defineProperty defeat the AST sanitizer for full server takeover (CVE-2026-25049)". AIR, AIR-2026-0031. https://agentincident.vercel.app/i/AIR-2026-0031/ (accessed 2026-10-19).