{"record":{"id":"30b166de17ac74d6","repo":"n8n-io/n8n","slug":"security-violation-constructor-access-is-not-al","errorCode":null,"errorMessage":"Security violation: 'constructor access' is not allowed","messagePattern":"Security violation: 'constructor access' is not allowed","errorType":"exception","errorClass":"SecurityError","httpStatus":null,"severity":"error","filePath":"packages/@n8n/workflow-sdk/src/ast-interpreter/validators.ts","lineNumber":313,"sourceCode":"\t// Check for dangerous patterns like eval(\"...\")\n\tif (node.callee.type === 'Identifier') {\n\t\tconst name = node.callee.name;\n\t\tif (name === 'eval') {\n\t\t\tthrow new SecurityError('eval()', node.loc ?? undefined, sourceCode);\n\t\t}\n\t\tif (name === 'Function') {\n\t\t\tthrow new SecurityError('Function()', node.loc ?? undefined, sourceCode);\n\t\t}\n\t\tif (name === 'require') {\n\t\t\tthrow new SecurityError('require()', node.loc ?? undefined, sourceCode);\n\t\t}\n\t}\n\n\t// Check for dangerous patterns like global.constructor.constructor\n\tif (node.callee.type === 'MemberExpression') {\n\t\tconst memberExpr = node.callee;\n\t\tif (memberExpr.property.type === 'Identifier' && memberExpr.property.name === 'constructor') {\n\t\t\tthrow new SecurityError('constructor access', node.loc ?? undefined, sourceCode);\n\t\t}\n\t}\n}\n\n/**\n * Validate a member expression.\n * @throws SecurityError if the access is dangerous\n */\nexport function validateMemberExpression(node: MemberExpression, sourceCode: string): void {\n\t// Reject dynamic property access obj[expr] (computed access)\n\t// Allow obj.property (non-computed)\n\tif (node.computed) {\n\t\t// Allow simple literal keys like obj[\"key\"] or obj[0]\n\t\tif (node.property.type !== 'Literal') {\n\t\t\tthrow new SecurityError(\n\t\t\t\t'computed-member-access',\n\t\t\t\tnode.loc ?? undefined,\n\t\t\t\tsourceCode,","sourceCodeStart":295,"sourceCodeEnd":331,"githubUrl":"https://github.com/n8n-io/n8n/blob/5ac6606e81f67bb9534255570cd4e86fd8101eee/packages/@n8n/workflow-sdk/src/ast-interpreter/validators.ts#L295-L331","documentation":"Thrown by validateCallExpression when the callee is a MemberExpression whose property is an Identifier named 'constructor'. Calling `.constructor(...)` is a known prototype-pollution / sandbox-escape vector (e.g., `{}.constructor.constructor('return process')()`). This guard blocks the invocation specifically.","triggerScenarios":"SDK code like `x.constructor(...)`, `obj.constructor.constructor(...)`, or any call where the callee is `something.constructor`. Property access of `.constructor` without calling it is caught separately by validateMemberExpression (1152).","commonSituations":"Intentional sandbox-escape attempts; copy-pasted exploit code; reflection-heavy utility code that walks prototypes.","solutions":["Remove all `.constructor(...)` calls from SDK code.","If you genuinely need to construct values, use literals (object/array/string/number literals) or the SDK factory functions.","Never use prototype-chain traversal in builder code — it is explicitly forbidden by design."],"exampleFix":"// before\nconst proc = {}.constructor.constructor('return process')();\n\n// after\n// There is no safe equivalent. Remove the call entirely.\n// Access process info at runtime in a Code node if absolutely needed.","handlingStrategy":"validation","validationCode":"function containsConstructorCall(code: string): boolean {\n  return /\\.constructor\\s*\\(/.test(code);\n}","typeGuard":"function callsConstructor(code: string): boolean {\n  return /\\.constructor\\s*\\(/.test(code);\n}","tryCatchPattern":"import { interpretSDKCode } from '@n8n/workflow-sdk/ast-interpreter/interpreter';\nimport { SecurityError } from '@n8n/workflow-sdk/ast-interpreter/errors';\n\ntry {\n  interpretSDKCode(code, sdkFunctions);\n} catch (e) {\n  if (e instanceof SecurityError && e.pattern === 'constructor access') {\n    // hard block — prototype-chain escape attempt\n  }\n  throw e;\n}","preventionTips":["Never traverse prototype chains or call .constructor().","Build values with literals, not reflective construction.","Lint for `.constructor(` and reject it."],"tags":["sdk","validators","security","prototype-pollution","sandbox-escape"],"backgroundTag":null,"analyzedSha":"5ac6606e81f67bb9534255570cd4e86fd8101eee","analyzedAt":"2026-08-12T05:26:35.080Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}