CVE-2026-85169: n8n before 1.123.73 Remote Code Execution via $fromAI Prototype Leak
n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain an expression sandbox escape in the $fromAI handler. $fromAI resolved a caller-supplied placeholder name without requiring it to be an own property and admitted reserved keys; against a primitive input value it returned a live host-prototype reference. An attacker with workflow-build privilege can walk the prototype chain to the Function constructor and compile/execute arbitrary code in the main n8n process, leading to remote code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 1.123.73 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.35.4 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.36.2
Event History
Frequently Asked Questions
Which releases include the fix?
The issue is fixed in n8n 1.123.73, 2.35.4, and 2.36.2. Versions before those respective releases are affected.
What level of access would an attacker need?
An attacker needs workflow-build privilege. With that privilege, they can exploit the $fromAI handler to reach the Function constructor and execute arbitrary code in the main n8n process.