CVE-2026-85169 is a high severity expression sandbox escape in n8n. The fromAI handler could hand back a live prototype reference, which lets someone with workflow build rights reach the Function constructor and run code in the main n8n process. Upgrade to 1.123.73, 2.35.4 or 2.36.2.
What's affected
- Product: n8n (npm package
n8n), expression handling for$fromAI. - Affected: before 1.123.73, before 2.35.4, and before 2.36.2.
- Fixed: 1.123.73, 2.35.4 and 2.36.2, or later.
- Privilege needed: the ability to build workflows, which the advisory describes as workflow build privilege.
Severity in the record: High, CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The GitHub advisory rates it High, 8.7 under CVSS v4. The record has 8.8 under CVSS v3.1.
Weakness class: CWE-94 (Code Injection).
How to check if you're exposed
- Find your version. For a global npm install,
n8n --versionprints it. For Docker, rundocker exec my-n8n n8n --version, or read the image tag. - Compare it with the fixed releases below. Remember that n8n has several release lines, so 1.x, 2.35.x and 2.36.x each have their own fixed number.
- Note who holds workflow create and edit rights on the instance, since several n8n flaws start from that privilege.
- List accounts that can create or edit workflows. Any of them could reach the flaw on an unpatched version.
What to do now
- Upgrade to 1.123.73, 2.35.4, 2.36.2 or a later release on your line.
- Until then, restrict the instance to fully trusted users, and turn off AI related nodes and features you do not use, as the advisory suggests.
- Run n8n under a dedicated low privilege operating system account.
- Review who holds workflow build rights and remove any that are not needed.
- Audit recently changed workflows for expressions nobody on the team recognizes.
Why it matters
n8n runs user written expressions inside a sandbox. The sandbox only works if no value inside it points back to real objects of the host runtime. Here the handler looked up a name supplied by the caller without checking that it was the object's own property, and it let reserved keys through. With a primitive input value, that returned a reference to a host prototype, and from a prototype an expression can climb to the code constructor. The weakness class is code injection, CWE-94.
For a workflow platform, the build privilege is already powerful, so a sandbox escape turns a content editor into an operator of the server. The same release line fixed several expression issues, and other posts in this series cover them. The record shows no sign of exploitation in the wild.
Quick check
Which n8n versions fix CVE-2026-85169?
1.123.73, 2.35.4 and 2.36.2, or any later version on the same line, according to the GitHub advisory.
Sources
Last reviewed: 18 October 2026.
