Haruna38

Authenticated content editors can achieve remote code execution via the '/element-index' endpoint. The issue occurs when a malicious class is injected through the `criteria` parameter, specifically via `criteria[withTransforms][0][class]`, which is then processed by the `normalizeTransform()` function. By utilizing a PHP gadget chain with `yiirbacPhpManager`, an attacker can execute arbitrary code by directing the `itemFile` variable to a request log that contains a PHP payload within the User-Agent header.

An expression sandbox escape exists in the `$fromAI` handler. The `$fromAI` handler resolved caller-supplied placeholder names without verifying if they were own properties and allowed reserved keys. When used against a primitive input value, it returned a live host-prototype reference. An attacker with workflow-build privileges can exploit this by walking the prototype chain to the `Function` constructor to compile and execute arbitrary code within the main n8n process, resulting in remote code execution.

A remote code execution issue exists in the @n8n/workflow-sdk node-schema loader used for MCP node-schema loading. The loader determines a node's schema module path using a node type string provided by the user without validating path-traversal sequences. An authenticated user with `global:member` privileges can use path traversal to reference malicious files, leading to code execution within the n8n main process.

Lodash versions 4.17.23 and earlier are susceptible to prototype pollution through the ` .unset` and ` .omit` functions. The initial fix did not fully address the issue, as an attacker can bypass the check by using array-wrapped path segments. This allows for the deletion of properties from built-in prototypes like Object.prototype, Number.prototype, and String.prototype. The issue allows deletion of prototype properties but does not permit overwriting their original behavior.