{"record":{"id":"0b7fcf102cd0c840","repo":"n8n-io/n8n","slug":"path-escapes-builder-workspace-root-path","errorCode":null,"errorMessage":"Path escapes builder workspace root: ${path}","messagePattern":"Path escapes builder workspace root: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/@n8n/instance-ai/src/workspace/scoped-workspace.ts","lineNumber":32,"sourceCode":"\ttype WorkspaceFilesystem,\n\ttype WorkspaceSandbox,\n\ttype WriteOptions,\n} from '@n8n/agents';\nimport { join as posixJoin, normalize as posixNormalize } from 'node:path/posix';\n\nfunction isInsideRoot(path: string, root: string): boolean {\n\tconst boundary = root.endsWith('/') ? root : `${root}/`;\n\treturn path === root || path.startsWith(boundary);\n}\n\nfunction resolvePath(root: string, path: string): string {\n\tconst normalizedRoot = posixNormalize(root);\n\tconst normalizedPath = path.startsWith('/')\n\t\t? posixNormalize(path)\n\t\t: posixNormalize(posixJoin(normalizedRoot, path));\n\n\tif (!isInsideRoot(normalizedPath, normalizedRoot)) {\n\t\tthrow new Error(`Path escapes builder workspace root: ${path}`);\n\t}\n\n\treturn normalizedPath;\n}\n\nclass ScopedFilesystem implements WorkspaceFilesystem {\n\tconstructor(\n\t\tprivate readonly filesystem: WorkspaceFilesystem,\n\t\tprivate readonly root: string,\n\t) {}\n\n\tget id() {\n\t\treturn `${this.filesystem.id}:scoped`;\n\t}\n\n\tget name() {\n\t\treturn `${this.filesystem.name} (builder scoped)`;\n\t}","sourceCodeStart":14,"sourceCodeEnd":50,"githubUrl":"https://github.com/n8n-io/n8n/blob/5ac6606e81f67bb9534255570cd4e86fd8101eee/packages/@n8n/instance-ai/src/workspace/scoped-workspace.ts#L14-L50","documentation":"Path-safety guard in resolvePath: after POSIX-normalizing the requested path and joining it onto the workspace root, the result no longer sits inside the root — the path uses '..' segments or an absolute prefix that escapes the builder workspace. The operation is refused to keep workspace isolation.","triggerScenarios":"Thrown at packages/@n8n/instance-ai/src/workspace/scoped-workspace.ts:32 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use a relative path that stays under the workspace root","Remove leading '..' segments or absolute prefixes from the path"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"5ac6606e81f67bb9534255570cd4e86fd8101eee","analyzedAt":"2026-08-12T05:26:35.080Z","contentChangedAt":"2026-08-12T05:26:35.080Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}