CVE-2026-77077

This CVE reveals an architectural flaw that runs deeper than a missed constructor: n8n's security model treats the task runner sandbox as an optional protective layer bolted onto an inherently insecure execution model, rather than as a foundational design constraint. The prototype-freezing routine that protects the VM context is manually maintained — someone had to enumerate every dangerous Node.js constructor and freeze it. They froze globalThis functions. They missed EventEmitter. This isn't negligence; it's what happens when security-critical enumeration depends on human memory under time pressure. The oversight suggests the threat model was built around publicly documented JavaScript hazards, not the full internal implementation surface of Node.js. The multi-tenant contamination vector is the critical risk. The runner container shares execution context across users for resource efficiency — a workflow friction decision that trades security for reduced infrastructure costs. The sandbox was supposed to protect against cross-tenant contamination, but it was incomplete. Once EventEmitter is accessible, a single Code node execution can pollute the shared runner state, affecting every subsequent Code node execution on that runner, from every tenant, indefinitely. This isn't a vulnerability with a per-user impact ceiling — it's a contamination vector that turns one exploit into persistent corruption of shared infrastructure. Worse, without task runners enabled, Code nodes execute directly in the main process. The secure multi-tenant sandbox requires additional configuration and infrastructure. The safest path is not the default path. Defensive guidance: assume any enumeration-based JavaScript sandbox will eventually fail. Treat authenticated user access as insufficient trust for Code node execution — the authentication boundary is being asked to carry security weight it was never designed for. Isolate runners aggressively, and assume compromise until proven otherwise. The real question isn't whether EventEmitter was missed — it's whether your threat model depends on enumeration staying current, which is a structural weakness, not a maintenance failure.

Reviewed through automated stages and approved by a human before publication.