n8n Sandbox Escape Lets Workflow Editors Run OS Commands as the n8n Process

n8n patched a high-severity expression-sandbox escape (tracked as GHSA-gv7g-jm28-cr3m, CVSS 8.7) that could let an authenticated workflow editor execute OS commands on the host, exposing the N8N_ENCRYPTION_KEY, stored credentials, and access to internal services; affected ranges were <2.31.5 and >=2.32.0,<2.32.1 with fixes in 2.31.5 and 2.32.1, and defenders are advised to update, review workflows for suspicious arrow functions or obfuscated JS, hunt for spawned shells, and rotate credentials where suspicious activity is found.