Disclosed vulnerability
CVE-2026-85169: n8n $fromAI prototype leak lets an expression escape the sandbox and run code on the host
AIR-2026-0258 AIR record · 2026-09-n8n-fromai-sandbox-escape-rce
From the supporting source
compile code running in the main n8n process, from workflow-build privilege alone.github.com
The record
Disclosed
2026-09-03
Vendor
n8n
Product
n8n
Risk domain
Access control and permissions › Privilege escalation
System type
Generative model
Who acted
AI was the target (contested) — expression sandbox escape in an automation platform; contested because $fromAI is the agent-parameter mechanism
Attack surface
Agent framework
Autonomy level
Assistant
Initial vector
Authenticated workflow author expression
Impact type
Remote code execution
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
n8n before 1.123.73, 2.35.4 and 2.36.2 for users able to build workflows
Capability abused
Defense & remediation
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
n8n 1.123.73, 2.35.4 and 2.36.2
Taxonomy & references
Curator notes
GitHub advisory GHSA-9x83-43r8-5hwc was published 2026-08-19 (CVSS 4.0 score 8.7); the CVE record was published 2026-09-03, which is the date used here. The $fromAI helper, which resolves placeholders that a model fills in, returned a live host-prototype reference, letting an expression reach the Function constructor and run code in the main n8n process. Requires workflow-build privilege. The advisory is a vulnerability description; no exploitation is reported.
Supporting sources
Cite as
Enkrypt AI. "CVE-2026-85169: n8n $fromAI prototype leak lets an expression escape the sandbox and run code on the host". AIR, AIR-2026-0258. https://agentincident.vercel.app/i/AIR-2026-0258/ (accessed 2026-10-19).