CVE-2026-85169CWE-94code-injection

CVE-2026-85169

High · published September 3, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
58.7
In the wild
Unconfirmed
What it is

n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain an expression sandbox escape in the $fromAI handler. $fromAI resolved a caller-supplied placeholder name without requiring it to be an own property and admitted reserved keys; against a primitive input value it returned a live host-prototype reference. An attacker with workflow-build privilege can walk the prototype chain to the Function constructor and compile/execute arbitrary code in the main n8n process, leading to remote code execution.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00879 · 58.7th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-09-03T17:06Z
Affected products (3)
ProductVersionsFixed in
n8n/n8n< 1.123.731.123.73
n8n/n8n≥ 2.0.0, < 2.35.42.35.4
n8n/n8n≥ 2.36.0, < 2.36.22.36.2
References (2)
https://github.com/n8n-io/n8n/security/advisories/GHSA-9x83-43r8-5hwc · [email protected]https://www.vulncheck.com/advisories/n8n-before-1.123.73-remote-code-execution-via-fromai-prototype-leak · [email protected]
EPSS history
Timeline
  • 05 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 03 SEP 11:22Z
    n8n before 1.123.73 Remote Code Execution via $fromAI Prototype Leak
    cvelistv5