n8n Expression Sandbox Escape Bypass: Detection and Remediation Guide

---
title: Potential n8n Sandbox Escape - Suspicious Shell Spawn
id: a1b2c3d4-5678-90ab-cdef-123456789012
status: experimental
description: Detects the n8n process spawning a shell (bash/sh/cmd), which may indicate a sandbox escape or abuse of RCE capabilities. Requires tuning for environments heavily using the 'Execute Command' node.
references:
  - https://thehackernews.com/2026/07/n8n-sandbox-escape-lets-workflow.html
author: Security Arsenal
date: 2026/07/08
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
      - '/n8n'
      - '/node' # n8n runs on node, process name may vary
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/zsh'
  filter_legitimate:
    # Optional: Add known legitimate command line patterns used by your workflows
    CommandLine|contains: 'known_legitimate_script_path'
  condition: selection and not filter_legitimate
falsepositives:
  - Legitimate use of the 'Execute Command' node by automation workflows
level: high
---
title: n8n Process Spawning Network Tools
id: b2c3d4e5-6789-01ab-cdef-234567890123
status: experimental
description: Detects n8n spawning common network enumeration tools (curl, wget, nc) often used in post-exploitation via sandbox escape.
references:
  - https://thehackernews.com/2026/07/n8n-sandbox-escape-lets-workflow.html
author: Security Arsenal
date: 2026/07/08
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
      - '/n8n'
      - '/node'
    Image|endswith:
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
  condition: selection
falsepositives:
  - Legitimate workflow automation tasks requiring network requests
level: medium

// Hunt for suspicious child processes spawned by n8n or Node.js processes running n8n
DeviceProcessEvents
| where Timestamp > ago(7d)
| where (InitiatingProcessFileName == "n8n" or (InitiatingProcessFileName == "node" and InitiatingProcessCommandLine contains "n8n"))
| where FileName in~ ("bash", "sh", "zsh", "cmd", "powershell", "curl", "wget", "python", "perl")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

-- Hunt for processes where the parent is n8n but the child is a shell or network tool
SELECT Pid, Name, CommandLine, Exe, Username
FROM pslist()
WHERE Parent.Name =~ "n8n"
   AND Name =~ "(bash|sh|zsh|curl|wget|nc|python|perl)"

#!/bin/bash

# n8n Vulnerability Check & Remediation Script
# Addresses: n8n Sandbox Escape Bypass (July 2026)
# Vulnerable Versions: < 2.31.5, >= 2.32.0 < 2.32.1

echo "[*] Checking n8n version..."

# Determine if n8n is installed via npm or running in container
if command -v npm &> /dev/null; then
    INSTALLED_VERSION=$(npm list -g n8n 2>/dev/null | grep n8n | awk '{print $2}' | tr -d '@')
    if [ -z "$INSTALLED_VERSION" ]; then
        # Check local project
        INSTALLED_VERSION=$(npm list n8n 2>/dev/null | grep n8n | awk '{print $2}' | tr -d '@')
    fi
    
    if [ ! -z "$INSTALLED_VERSION" ]; then
        echo "[+] Detected n8n version: $INSTALLED_VERSION"
        
        # Version comparison logic (simplified for demonstration, use sort -V for production robustness)
        # Check if version is < 2.31.5 or >= 2.32.0 < 2.32.1
        # Note: Exact semantic version parsing in bash is complex; consult package. for accuracy.
        
        echo "[!] Reviewing version against vulnerable ranges (< 2.31.5 or >= 2.32.0, < 2.32.1)..."
        echo "[+] Remediation: Run 'npm update n8n' to update to the latest safe version (2.31.5 or 2.32.1+)."
    else
        echo "[-] n8n not found via npm. Checking Docker..."
    fi
fi

if command -v docker &> /dev/null; then
    echo "[*] Checking Docker containers..."
    docker ps --format "{{.Names}}" | while read -r container; do
        # Check if container name includes n8n or image is n8n
        if docker inspect "$container" | grep -q "n8n"; then
            echo "[+] Found potential n8n container: $container"
            echo "    Image: $(docker inspect -f '{{.Config.Image}}' "$container")"
            echo "    Remediation: Update the image tag to n8nio/n8n:latest-2.31.5 or n8nio/n8n:latest-2.32.1 and redeploy."
        fi
    done
fi

echo "[*] Scan complete."