AI Threat AlertCVE-2026-85169: n8n: $fromAI sandbox escape enables RCE
HIGHA flaw in n8n's $fromAI handler lets an authenticated workflow builder walk the JavaScript prototype chain to the Function constructor and execute arbitrary code in the main n8n process, effectively escaping the expression sandbox meant to isolate AI Agent tool parameters. This matters because n8n underpins agentic automation for 16+ downstream dependents and carries a package risk score of 69/100 with 211 other CVEs already recorded against it, signaling a track record of security debt in a tool increasingly wired into production AI workflows with access to credentials and internal systems. There's no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, so this looks pre-weaponization rather than under active attack — but the technique (an own-property/reserved-key bypass leading to a live prototype reference) is a well-understood class of JS sandbox escape that a moderately skilled attacker could reproduce from the public GHSA advisory alone. Any org running self-hosted n8n with AI Agent nodes and multiple workflow editors should treat this as urgent: upgrade to 1.123.73, 2.35.4, or 2.36.2 immediately, and in the interim restrict workflow-build/editor roles to trusted users and audit workflows for $fromAI usage with attacker-controllable placeholder names.
What is the risk?
Functionally critical despite the missing CVSS score: successful exploitation yields arbitrary code execution in the main n8n process, exposing all credentials, connected integrations, and stored workflow data on the instance. The barrier to exploitation is workflow-build privilege — not admin, just the ability to author or edit a workflow — which in many n8n deployments is granted broadly to automation engineers, ops staff, or even external contractors. No EPSS percentile, KEV listing, or public PoC/Nuclei template exists yet, so opportunistic mass exploitation is unlikely in the short term; the primary near-term risk is targeted abuse by a malicious or compromised insider with editor access, or lateral movement following compromise of a lower-privileged n8n account.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| n8n | npm | — | No patch |
Do you use n8n? You're affected.
How severe is it?
What should I do?
1 stepPatch immediately to n8n 1.123.73, 2.35.4, or 2.36.2, which fix the own-property and reserved-key validation in the $fromAI resolver. If immediate patching isn't possible, restrict workflow-build/editor roles to trusted, vetted users only, and audit existing workflows for AI Agent nodes calling $fromAI with attacker-influenceable placeholder names (especially reserved keys like constructor, __proto__, or prototype). For detection, monitor n8n process logs and host-level EDR for unexpected child processes, Function constructor invocations, or outbound connections originating from the n8n Node.js process outside expected workflow execution, and review the GHSA-9x83-43r8-5hwc advisory and the VulnCheck writeup for exact indicator patterns.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-85169?
A flaw in n8n's $fromAI handler lets an authenticated workflow builder walk the JavaScript prototype chain to the Function constructor and execute arbitrary code in the main n8n process, effectively escaping the expression sandbox meant to isolate AI Agent tool parameters. This matters because n8n underpins agentic automation for 16+ downstream dependents and carries a package risk score of 69/100 with 211 other CVEs already recorded against it, signaling a track record of security debt in a tool increasingly wired into production AI workflows with access to credentials and internal systems. There's no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, so this looks pre-weaponization rather than under active attack — but the technique (an own-property/reserved-key bypass leading to a live prototype reference) is a well-understood class of JS sandbox escape that a moderately skilled attacker could reproduce from the public GHSA advisory alone. Any org running self-hosted n8n with AI Agent nodes and multiple workflow editors should treat this as urgent: upgrade to 1.123.73, 2.35.4, or 2.36.2 immediately, and in the interim restrict workflow-build/editor roles to trusted users and audit workflows for $fromAI usage with attacker-controllable placeholder names.
Is CVE-2026-85169 actively exploited?
No confirmed active exploitation of CVE-2026-85169 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-85169?
Patch immediately to n8n 1.123.73, 2.35.4, or 2.36.2, which fix the own-property and reserved-key validation in the $fromAI resolver. If immediate patching isn't possible, restrict workflow-build/editor roles to trusted, vetted users only, and audit existing workflows for AI Agent nodes calling $fromAI with attacker-influenceable placeholder names (especially reserved keys like constructor, __proto__, or prototype). For detection, monitor n8n process logs and host-level EDR for unexpected child processes, Function constructor invocations, or outbound connections originating from the n8n Node.js process outside expected workflow execution, and review the GHSA-9x83-43r8-5hwc advisory and the VulnCheck writeup for exact indicator patterns.
What systems are affected by CVE-2026-85169?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation, orchestration pipelines.
What is the CVSS score for CVE-2026-85169?
No CVSS score has been assigned yet.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0050Command and Scripting InterpreterAML.T0053AI Agent Tool InvocationAML.T0105Escape to HostAML.T0112Machine CompromiseCompliance Controls Affected
What are the technical details?
Original Advisory
n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain an expression sandbox escape in the $fromAI handler. $fromAI resolved a caller-supplied placeholder name without requiring it to be an own property and admitted reserved keys; against a primitive input value it returned a live host-prototype reference. An attacker with workflow-build privilege can walk the prototype chain to the Function constructor and compile/execute arbitrary code in the main n8n process, leading to remote code execution.
Exploitation Scenario
A contractor or low-trust automation engineer with workflow-build access in a shared n8n instance creates an AI Agent node and configures a $fromAI expression using a placeholder name that maps to a reserved/prototype key (e.g., constructor) instead of an own property. When the handler resolves this against a primitive input value, $fromAI returns a live reference into the host's JavaScript prototype chain rather than a sandboxed copy. The attacker walks that chain to reach the Function constructor, compiles arbitrary JavaScript, and executes it with the same privileges as the main n8n process — harvesting stored credentials for every connected integration (databases, SaaS APIs, cloud accounts) and pivoting further into the environment.
Weaknesses (CWE)
CWE-94 — Improper Control of Generation of Code: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
- [Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
- [Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.
Source: MITRE CWE corpus.
References
Timeline
Related Vulnerabilities
CVE-2026-3366310.0n8n: member role steals plaintext HTTP credentials
Same package: n8nCVE-2026-3366010.0TensorFlow: type confusion NPD in tensor conversion
Same package: n8nCVE-2026-2185810.0n8n: Input Validation flaw enables exploitation
Same package: n8nCVE-2026-275779.9n8n: Code Injection enables RCE
Same package: n8nCVE-2026-274949.9n8n: security flaw enables exploitation
Same package: n8n