n8n-io/n8n · error · ExpressionError

Cannot override "__sanitize" due to security concerns

Error message

Cannot override "__sanitize" due to security concerns

What it means

Error "Cannot override "__sanitize" due to security concerns" thrown in n8n-io/n8n.

Source

Thrown at packages/@n8n/expression-runtime/src/runtime/context.ts:124

 */
export function buildContext(
	callbacks: BridgeCallbacks,
	timezone?: string,
): Record<string, unknown> {
	if (timezone && !IANAZone.isValidZone(timezone)) {
		throw new Error(`Invalid timezone: "${timezone}"`);
	}
	Settings.defaultZone = timezone ?? 'system';

	const target: Record<string, unknown> = {};

	// __sanitize must be on the context because PrototypeSanitizer generates:
	// obj[this.__sanitize(expr)] where 'this' is the context (via .call(ctx) wrapping)
	// Use a non-writable property descriptor so override attempts throw instead of silently succeeding.
	Object.defineProperty(target, '__sanitize', {
		get: () => __sanitize,
		set: () => {
			throw new ExpressionError('Cannot override "__sanitize" due to security concerns');
		},
		enumerable: false,
		configurable: false,
	});

	// -------------------------------------------------------------------------
	// Create DateTime values inside the isolate (not lazy-loaded from host,
	// because host-side DateTime objects lose their prototype crossing the
	// boundary). The isolate has its own luxon with the correct timezone
	// already set via Settings.defaultZone above.
	// -------------------------------------------------------------------------

	target.$now = DateTime.now();
	target.$today = DateTime.now().set({ hour: 0, minute: 0, second: 0, millisecond: 0 });

	// -------------------------------------------------------------------------
	// Expose standalone functions (min, max, average, numberList, zip, $ifEmpty, etc.)
	// -------------------------------------------------------------------------

View on GitHub (pinned to 5ac6606e81)

When it happens

Trigger: Thrown at packages/@n8n/expression-runtime/src/runtime/context.ts:124 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of n8n-io/n8n@5ac6606e81 (2026-08-12). Data as JSON: /api/errors/74c07bca1bdea173. Report an issue: GitHub.