n8n Remote Code Execution (Critical)

A critical expression injection vulnerability in n8n workflow automation platform that allows authenticated users to execute arbitrary code on the server.

## Vulnerability Overview
n8n is a popular open-source workflow automation tool. This vulnerability exists in the expression evaluation engine, which uses the vm2 library (or its successor) to sandbox JavaScript expressions in workflow nodes. An authenticated attacker can craft a workflow expression that escapes the sandbox and executes arbitrary Node.js code on the server.

## Technical Details
- **Type:** Expression/Code Injection (CWE-94)
- **CVSS Score:** 9.9 — Critical
- **Root Cause:** The expression evaluation sandbox can be bypassed using prototype pollution and Proxy object manipulation. By crafting a specific chain of JavaScript expressions, an attacker can access the underlying Node.js process object and execute arbitrary commands.
- **Authentication:** Requires a valid n8n user account (any role with workflow edit permissions)

## Proof of Concept
A public PoC demonstrates the sandbox escape via a crafted expression in a Code node. The expression uses constructor chaining to break out of the vm2 sandbox and spawn child processes.

## Impact
- Full RCE on the n8n server with the privileges of the n8n process
- Access to all workflow data, credentials, and connected services
- Lateral movement to services connected via n8n integrations
- Data exfiltration from databases and APIs connected to n8n