Executive brief
n8n is a workflow automation platform that allows users to build and execute automated workflows. This vulnerability allows attackers with workflow-build access to escape the expression sandbox and execute arbitrary code on the underlying n8n process, potentially compromising the entire system and any data it has access to.
Technical details
The $fromAI expression handler contains a prototype pollution vulnerability where it resolves caller-supplied placeholder names without validating them as own properties or blocking reserved keys. When supplied with a primitive input value, this returns a live reference to the host prototype chain. An attacker with workflow-build privilege can traverse this prototype chain to the Function constructor, allowing them to compile and execute arbitrary code within the main n8n process context. The vulnerability requires only workflow-build access (low privilege) and no user interaction. The issue has been patched in versions 1.123.73, 2.35.4, and 2.36.2.
Affected products
- n8n n8n before 1.123.73, 2.35.4, and 2.36.2
Timeline
- 2026-08-19: disclosed
- 2026-09-03: advisory