n8n: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code Execution

Impact The expression compiler's sanitizer resolved through a dynamically-scoped this, so a class field named sanitize rebound it and reached the Function constructor. On the backend, any expression author could run code in the n8n process; in the editor preview, a member's expression could run a...

NPM: n8n: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code Execution

NPM: n8n: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code Execution vulnerability discovered by ? in WordPress Npm n8n versions 1.123.76...