CVE-2026-85169

n8n releases before 1.123.73, 2.35.4, and 2.36.2 contain an expression sandbox escape in the $fromAI handler that allows arbitrary code execution in the main n8n process. The flaw occurs because $fromAI resolves a caller-supplied placeholder name without verifying it is an own property and admits reserved keys; when applied to a primitive input value it returns a live host-prototype reference, letting an attacker walk the prototype chain to the Function constructor and compile/execute arbitrary JavaScript. Exploitation is over the network with low privileges and no user interaction (CVSS 4.0: 8.7 High), but requires the attacker to have workflow-build privilege, i.e., the ability to create or modify workflows. Anyone running an affected self-hosted n8n version who allows untrusted or semi-trusted users to build workflows is affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and EPSS currently estimates the 30-day exploitation probability at about 0.4% (percentile 32).

What to do: Upgrade self-hosted n8n to 1.123.73 if tracking the 1.x line, or to 2.35.4 / 2.36.2 if tracking the 2.x lines. Until patched, restrict workflow creation and editing to trusted users only, since exploitation requires workflow-build privilege, and review workflows that call $fromAI with unusual or reserved placeholder names. Internet-exposed n8n instances should be treated as priority targets given the RCE impact.