CVE-2026-85169
Received Received - Intake

Expression Sandbox Escape in n8n Leading to Remote Code Execution

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: VulnCheck

Description
n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain an expression sandbox escape in the $fromAI handler. $fromAI resolved a caller-supplied placeholder name without requiring it to be an own property and admitted reserved keys; against a primitive input value it returned a live host-prototype reference. An attacker with workflow-build privilege can walk the prototype chain to the Function constructor and compile/execute arbitrary code in the main n8n process, leading to remote code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-85169
EUVD
EUVD-2026-70404

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
n8n n8n to 1.123.73 (exc)
n8n n8n 2.35.4
n8n n8n 2.36.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-85169 is a remote code execution vulnerability in n8n versions before 1.123.73, 2.35.4, and 2.36.2. It involves an expression sandbox escape in the $fromAI handler where caller-supplied placeholder names are resolved without validating them as own properties. This allows reserved keys to be accessed and returns a live host-prototype reference for primitive input values. Attackers with workflow-build privileges can traverse the prototype chain to the Function constructor and execute arbitrary code in the main n8n process.

Detection Guidance

To detect this vulnerability, check the version of n8n installed on your system. Compare it against the patched versions (1.123.73, 2.35.4, or 2.36.2). Run commands like 'n8n --version' or check the package.json file in your n8n installation directory. If your version is below these, the system is vulnerable.

Impact Analysis

If exploited, this vulnerability allows attackers to execute arbitrary code on the system running n8n. This could lead to unauthorized access, data theft, system compromise, or disruption of services. Attackers only need workflow-build privileges to exploit it, making it dangerous if untrusted users have such access.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations using vulnerable n8n versions may face compliance breaches, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately upgrade n8n to a patched version (1.123.73, 2.35.4, or 2.36.2). As temporary measures, restrict instance access to trusted users, disable AI-related features, and run n8n under a low-privilege OS account to limit potential damage.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85169. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart