---
id: "GHSA-gx3v-3x3v-f8r5"
page: "https://infrastack.ai/live/GHSA-gx3v-3x3v-f8r5"
kind: "vulnerability"
aliases: ["GHSA-gx3v-3x3v-f8r5"]
title: "Insufficient Isolation in Workflow Expression Evaluation"
severity: "high"
cvss: 7.7
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "n8n", "fixed": [">= 1.123.89"], "affected": "< 1.123.89", "ecosystem": "npm"}, {"name": "n8n", "fixed": [">= 2.46.1"], "affected": "< 2.46.1", "ecosystem": "npm"}, {"name": "n8n", "fixed": [">= 2.45.5"], "affected": "< 2.45.5", "ecosystem": "npm"}, {"name": "n8n", "fixed": [">= 3.0.1"], "affected": "< 3.0.1", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["ai-tooling", "n8n", "self-hosted", "workflow-automation"]
not_affected_if: ["managed-hosting", "no-workflow-editors-untrusted"]
published_at: "2026-10-28T08:47:50+00:00"
first_seen_at: "2026-11-09T22:53:25+00:00"
updated_at: "2026-11-09T22:54:14+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-gx3v-3x3v-f8r5", "first_seen_at": "2026-11-09T22:53:25+00:00"}]
exploit_sources: []
---

# Insufficient Isolation in Workflow Expression Evaluation

Link for people: https://infrastack.ai/live/GHSA-gx3v-3x3v-f8r5 (this .md is for agents)

An authenticated user who can create or modify n8n workflows can escape the sandbox used for workflow expression evaluation. That lets them execute arbitrary code on the n8n server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:n8n affected < 1.123.89 fixed >= 1.123.89
- npm:n8n affected < 2.46.1 fixed >= 2.46.1
- npm:n8n affected < 2.45.5 fixed >= 2.45.5
- npm:n8n affected < 3.0.1 fixed >= 3.0.1

## How to check

- Check the installed n8n version with `n8n --version` or in the `n8n` npm package in `package.json`; affected versions are below `1.123.89`, `2.45.5`, `2.46.1` and `3.0.1` depending on release line.
- Review which users hold `global:member` or workflow-edit permissions.
- Audit workflows for expressions referencing unexpected JavaScript properties.

## Fix

- n8n `1.123.89`
- n8n `2.45.5`
- n8n `2.46.1`
- n8n `3.0.1`

## Timeline

- 2026-11-09T22:53:25+00:00 ghsa-repo https://github.com/n8n-io/n8n/security/advisories/GHSA-gx3v-3x3v-f8r5

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/n8n-io/n8n/security/advisories/GHSA-gx3v-3x3v-f8r5

## From the sources

## Impact

An authenticated user with permission to create or modify workflows could escape the isolation applied to workflow expression evaluation and execute arbitrary code on the n8n host. 

## Patches

The issue has been fixed in n8n versions 1.123.89, 2.45.5, 2.46.1 and 3.0.1. Users should upgrade to one of these versions or later to remediate the vulnerability.

## Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Restrict n8n instance access to fully trusted users only.
- Remove `global:member` access from any users who are not fully trusted until the instance is patched.
- Audit active workflows for expressions that reference unexpected JavaScript properties.
- Use the `NODES_EXCLUDE` environment variable and instance hardening settings to limit the attack surface of the running instance.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_