n8n: N8n versions before 1.123.73, 2.35.4, and 2.36.2 contain an expression sandbox escape in the…
n8n
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-85169
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- September 3, 2026
- Source last modified
- September 18, 2026
Description
n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain an expression sandbox escape in the $fromAI handler. $fromAI resolved a caller-supplied placeholder name without requiring it to be an own property and admitted reserved keys; against a primitive input value it returned a live host-prototype reference. An attacker with workflow-build privilege can walk the prototype chain to the Function constructor and compile/execute arbitrary code in the main n8n process, leading to remote code execution.
Description quoted from the NVD record.
Who is affected
This flaw affects n8n, a tool for connecting different apps and automating routine tasks. It affects n8n versions before 1.123.73, 2.35.4 and 2.36.2. The problem is in a part of the product that handles expressions (small formulas used inside workflows), specifically one used for values filled in by AI. Someone who is allowed to build or edit workflows could break out of the safety limits placed on these expressions and run any program code they choose inside the main n8n program, on the computer that runs it. This flaw is rated High.
What to do
- Find out who looks after n8n for your organization: the person who installed or runs it, or the IT provider or vendor that manages it for you.
- If someone in your organization runs n8n, they should update it to version
1.123.73,2.35.4or2.36.2, or a later release, picking the one that matches the version line you use now. - If an IT provider or vendor runs n8n for you, send them this advisory and ask when the update will be done.
- For more detail on the fixed releases, see the vendor advisory linked on this page.
Analysis written from the source record as of September 18, 2026 and reviewed before publishing.