CVE-2026-77083
CVSS 6 fundamentally misjudges CVE-2026-77083 because the actual blast radius isn't determined by exploit sophistication — it's determined by your deployment's module allowlist configuration, and that's something the CVSS system structurally cannot price in. In n8n, the vulnerability allows sandbox escape via Function.prototype pollution in the Code node's JavaScript execution environment. The CVE notes the exploit "additionally depends on specific modules being available as allowlisted imports" — but what nobody's pressing is whether those dangerous modules ship in the default allowlist. If your n8n instance came with `fs`, `child_process`, `crypto`, or `net` pre-allowlisted for workflow convenience, then the sandbox escape isn't a theoretical exercise. It's host compromise. The Code node isn't just a feature — it's the platform's core value proposition, which means "authenticated attacker" doesn't mean a privileged insider. Any team member with workflow-building access likely has Code node access. Here's what you need to do. First, audit your module allowlist immediately: every module that provides filesystem access, process spawning, cryptographic primitives, or network sockets becomes an exploitation primitive post-escape, not just a workflow enabler. Second, assume the answer to "has this been exploited" is unknown — sandbox escapes are silent. Unlike SQL injection or spawned processes, escaping the VM and pivoting to mounted volumes leaves no canonical fingerprint unless you're specifically monitoring VM boundary violations. Third, rotate credentials stored in n8n. The patch fixes the boundary but doesn't invalidate credentials that may have already been exfiltrated during the vulnerable window. The fix itself (freezing Function.prototype) creates a dangerous illusion: organizations patch, mark it resolved, and never audit their allowlist because the CVE says medium. You've patched one escape vector while the post-escape primitives remain unchanged. The remediation has two tracks — the code patch and the configuration audit — and CVE tracking conflates them into one action. Don't let that happen.
Reviewed through automated stages and approved by a human before publication.