The $fromAI handler in n8n’s expression sandbox resolves user‑supplied placeholder names without confirming they are own properties or checking against reserved keys. When supplied with a primitive value, this logic returns a live host‑prototype reference, allowing an attacker to navigate the prototype chain. From the Function constructor reachable via the prototype chain the attacker can compile and execute arbitrary code within the main n8n process, resulting in full remote code execution.

This flaw affects the n8n workflow automation tool distributed by n8n‑io. Versions prior to 1.123.73, 2.35.4, and 2.36.2 are vulnerable. Any instance of the software that has not yet been updated to a patched release is at risk, particularly if users can create or edit workflows.

The vulnerability carries a CVSS score of 8.7, indicating high severity. EPSS data is not available and the flaw is not currently listed in the CISA KEV catalog. Exploitation requires the ability to build or modify workflows; an attacker with workflow‑build privilege can inject malicious expressions and gain code execution rights within the n8n process. Although the attack vector is internal to the workflow execution environment, a compromised n8n instance could provide a foothold for further lateral or remote attacks.