A critical remote code execution vulnerability exists in n8n due to an improper expression sandbox escape, which could allow an authenticated attacker to execute arbitrary code on the host system.

This vulnerability involves a code injection flaw (CWE-94) within the expression sandbox, which permits an authenticated user with low privileges to bypass security restrictions and execute arbitrary system commands.

Successful exploitation of this vulnerability allows an attacker to compromise the host server, potentially leading to full system takeover and unauthorized access to sensitive workflow data. Given the CVSS score of 8.7, this is a high-severity issue that poses a significant risk to the confidentiality, integrity, and availability of the affected environment.

Immediate Action: Update n8n to version 2.32.1 or 2.31.5 immediately to incorporate the necessary sandbox security patches.

Proactive Monitoring: Monitor server logs for unexpected process execution or abnormal outbound network connections originating from the n8n application service.

Compensating Controls: Ensure the n8n instance is running with the least privilege necessary, and consider isolating the application within a containerized environment with restricted egress traffic to limit the impact of potential command execution.

Public Exploit Available: Unknown.

The severity of this remote code execution vulnerability necessitates immediate action. Administrators must prioritize updating to the specified patched versions to prevent potential compromise of their n8n automation infrastructure.