Description
n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain an expression sandbox escape in the $fromAI handler. $fromAI resolved a caller-supplied placeholder name without requiring it to be an own property and admitted reserved keys; against a primitive input value it returned a live host-prototype reference. An attacker with workflow-build privilege can walk the prototype chain to the Function constructor and compile/execute arbitrary code in the main n8n process, leading to remote code execution.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n8n-io n8n
Default version status: unaffected
0 to < 1.123.73affected1.123.73unaffected
pkg:npm/n8nn8n-io n8n
Default version status: unaffected
2.36.0 to < 2.36.2affected2.36.2unaffected
pkg:npm/n8nn8n-io n8n
Default version status: unaffected
2.0.0-rc.0 to < 2.35.4affected2.35.4unaffected
pkg:npm/n8n