Risks in agent orchestration platforms: n8n's expression sandbox has structural flaws; external isolation cannot solve the root problem
智能体编排平台风险：表达式沙箱存在结构性缺陷，外部隔离不能解决根源问题
Pillar Security researchers Eilon Cohen and Ariel Fogel published a preprint paper in September 2026 titled "Weird Machine Compositors," claiming that the expression sandbox in orchestration platforms like n8n has structural flaws, and that blacklist defenses based on enumeration and blocking cannot keep up with updates to the JavaScript language specification. The authors conducted three rounds of bypass verification against n8n. In the first round, on December 21, 2025, they escaped using TaggedTemplate combined with prepareStackTrace, corresponding to CVE-2026-25049 (CVSS 9.4); n8n applied nine targeted patches in v2.4.0. In the second round, they switched to SpreadElement to complete the escape at the compilation stage, rendering runtime patches ineffective. The third round involved unauthenticated attackers who could trigger the issue without an account.
Using n8n's three-round sandbox bypass and three CVEs as examples, the paper shows that blacklist-style defenses cannot keep up with language specification updates, and proposes an alternative minimal allowlist approach.