A critical sandbox escape vulnerability in n8n allows authenticated attackers to execute arbitrary code on the host system via the $fromAI handler.

The vulnerability exists in the $fromAI expression handler, which fails to properly validate placeholder names. An attacker with workflow-build permissions can exploit this to walk the prototype chain, access the Function constructor, and execute arbitrary code within the main n8n process.

A successful exploit grants an attacker the ability to execute arbitrary code on the server hosting the n8n application. This level of access typically results in full system compromise, data exfiltration, and the potential for lateral movement within the internal network. With a CVSS score of 8.7, this flaw represents a significant risk to organizational integrity, especially in environments where n8n has access to sensitive integrations or internal credentials.

Immediate Action: Update n8n instances to version 1.123.73, 2.35.4, 2.36.2, or later to incorporate the security patch for the $fromAI handler.

Proactive Monitoring: Review workflow logs for suspicious expressions or attempts to access restricted object prototypes. Monitor system logs for unexpected process execution or unauthorized network connections originating from the n8n service account.

Compensating Controls: Restrict workflow-build privileges to trusted users only. Implement network segmentation to ensure the n8n instance operates with minimal necessary permissions to reduce the impact of a potential compromise.

Public Exploit Available: No

Given the potential for remote code execution, this vulnerability poses a severe threat to any deployment of n8n. Administrators must prioritize the application of the provided security patches across all production environments. Restricting access to workflow-building capabilities remains a critical secondary defense while the update is being staged and deployed.