{"record":{"id":"6b986baf77111543","repo":"n8n-io/n8n","slug":"security-violation-require-is-not-allowed","errorCode":null,"errorMessage":"Security violation: 'require()' is not allowed","messagePattern":"Security violation: 'require\\(\\)' is not allowed","errorType":"exception","errorClass":"SecurityError","httpStatus":null,"severity":"error","filePath":"packages/@n8n/workflow-sdk/src/ast-interpreter/validators.ts","lineNumber":305,"sourceCode":"\t}\n}\n\n/**\n * Validate a function call expression.\n * @throws SecurityError if the call is dangerous\n */\nexport function validateCallExpression(node: CallExpression, sourceCode: string): void {\n\t// Check for dangerous patterns like eval(\"...\")\n\tif (node.callee.type === 'Identifier') {\n\t\tconst name = node.callee.name;\n\t\tif (name === 'eval') {\n\t\t\tthrow new SecurityError('eval()', node.loc ?? undefined, sourceCode);\n\t\t}\n\t\tif (name === 'Function') {\n\t\t\tthrow new SecurityError('Function()', node.loc ?? undefined, sourceCode);\n\t\t}\n\t\tif (name === 'require') {\n\t\t\tthrow new SecurityError('require()', node.loc ?? undefined, sourceCode);\n\t\t}\n\t}\n\n\t// Check for dangerous patterns like global.constructor.constructor\n\tif (node.callee.type === 'MemberExpression') {\n\t\tconst memberExpr = node.callee;\n\t\tif (memberExpr.property.type === 'Identifier' && memberExpr.property.name === 'constructor') {\n\t\t\tthrow new SecurityError('constructor access', node.loc ?? undefined, sourceCode);\n\t\t}\n\t}\n}\n\n/**\n * Validate a member expression.\n * @throws SecurityError if the access is dangerous\n */\nexport function validateMemberExpression(node: MemberExpression, sourceCode: string): void {\n\t// Reject dynamic property access obj[expr] (computed access)","sourceCodeStart":287,"sourceCodeEnd":323,"githubUrl":"https://github.com/n8n-io/n8n/blob/5ac6606e81f67bb9534255570cd4e86fd8101eee/packages/@n8n/workflow-sdk/src/ast-interpreter/validators.ts#L287-L323","documentation":"Thrown by validateCallExpression when a CallExpression's callee is an Identifier named 'require'. require() would load arbitrary Node.js modules, breaking sandboxing. Blocked alongside eval and Function as a hard security boundary.","triggerScenarios":"SDK code containing `require('...')` calls — e.g., `const fs = require('fs')`, `const _ = require('lodash')`. Any CommonJS import in builder code.","commonSituations":"Pasting Node.js snippets that import built-ins (fs, path) or third-party libraries; attempting to share utilities via require.","solutions":["Remove all require() calls from SDK builder code — it cannot load modules.","If you need a library's behavior, replicate it inline with allowed constructs, or run that logic in a Code node (Code nodes have their own module rules).","For data transformations, use n8n's Set node / expressions instead of a library like lodash."],"exampleFix":"// before\nconst _ = require('lodash');\nconst merged = _.merge(a, b);\n\n// after\nconst merged = { ...a, ...b };","handlingStrategy":"validation","validationCode":"function containsRequire(code: string): boolean {\n  return /\\brequire\\s*\\(/.test(code);\n}","typeGuard":"function usesRequire(code: string): boolean {\n  return /\\brequire\\s*\\(/.test(code);\n}","tryCatchPattern":"import { interpretSDKCode } from '@n8n/workflow-sdk/ast-interpreter/interpreter';\nimport { SecurityError } from '@n8n/workflow-sdk/ast-interpreter/errors';\n\ntry {\n  interpretSDKCode(code, sdkFunctions);\n} catch (e) {\n  if (e instanceof SecurityError && e.pattern === 'require()') {\n    // hard block — builder cannot load modules\n  }\n  throw e;\n}","preventionTips":["Ban require via lint. Builder code is module-free by design.","Inline small utilities with allowed constructs; move larger logic to Code nodes.","Replace lodash/underscore helpers with spread/object-literal equivalents."],"tags":["sdk","validators","security","require","module-loading"],"backgroundTag":null,"analyzedSha":"5ac6606e81f67bb9534255570cd4e86fd8101eee","analyzedAt":"2026-08-12T05:26:35.080Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}