CVE-2026-85169

Analyzed Analyzed - Analysis Complete

Expression Sandbox Escape in n8n Leading to Remote Code Execution

Publication date: 2026-09-03

Last updated on: 2026-10-29

Assigner: VulnCheck

Description

n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain an expression sandbox escape in the $fromAI handler. $fromAI resolved a caller-supplied placeholder name without requiring it to be an own property and admitted reserved keys; against a primitive input value it returned a live host-prototype reference. An attacker with workflow-build privilege can walk the prototype chain to the Function constructor and compile/execute arbitrary code in the main n8n process, leading to remote code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-03

Last Modified

2026-10-29

Generated

2026-11-08

AI Q&A

2026-09-03

EPSS Evaluated

2026-11-07

NVD

CVE-2026-85169

EUVD

EUVD-2026-70404

Affected Vendors & Products

Vendor	Product	Version / Range
n8n	n8n	From 2.36.0 (inc) to 2.36.2 (exc)
n8n	n8n	to 1.123.73 (exc)
n8n	n8n	From 2.0.0 (inc) to 2.35.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

CVE-2026-85169 is a remote code execution vulnerability in n8n versions before 1.123.73, 2.35.4, and 2.36.2. It involves an expression sandbox escape in the $fromAI handler where caller-supplied placeholder names are resolved without validating them as own properties. This allows reserved keys to be accessed and returns a live host-prototype reference for primitive input values. Attackers with workflow-build privileges can traverse the prototype chain to the Function constructor and execute arbitrary code in the main n8n process.

Detection Guidance

To detect this vulnerability, check the version of n8n installed on your system. Compare it against the patched versions (1.123.73, 2.35.4, or 2.36.2). Run commands like 'n8n --version' or check the package.json file in your n8n installation directory. If your version is below these, the system is vulnerable.

Impact Analysis

If exploited, this vulnerability allows attackers to execute arbitrary code on the system running n8n. This could lead to unauthorized access, data theft, system compromise, or disruption of services. Attackers only need workflow-build privileges to exploit it, making it dangerous if untrusted users have such access.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations using vulnerable n8n versions may face compliance breaches, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately upgrade n8n to a patched version (1.123.73, 2.35.4, or 2.36.2). As temporary measures, restrict instance access to trusted users, disable AI-related features, and run n8n under a low-privilege OS account to limit potential damage.

Hi! I’m here to help you understand CVE-2026-85169. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...