n8n-io/n8n · error · SecurityError

Security violation: 'require()' is not allowed

Error message

Security violation: 'require()' is not allowed

What it means

Thrown by validateCallExpression when a CallExpression's callee is an Identifier named 'require'. require() would load arbitrary Node.js modules, breaking sandboxing. Blocked alongside eval and Function as a hard security boundary.

Source

Thrown at packages/@n8n/workflow-sdk/src/ast-interpreter/validators.ts:305

	}
}

/**
 * Validate a function call expression.
 * @throws SecurityError if the call is dangerous
 */
export function validateCallExpression(node: CallExpression, sourceCode: string): void {
	// Check for dangerous patterns like eval("...")
	if (node.callee.type === 'Identifier') {
		const name = node.callee.name;
		if (name === 'eval') {
			throw new SecurityError('eval()', node.loc ?? undefined, sourceCode);
		}
		if (name === 'Function') {
			throw new SecurityError('Function()', node.loc ?? undefined, sourceCode);
		}
		if (name === 'require') {
			throw new SecurityError('require()', node.loc ?? undefined, sourceCode);
		}
	}

	// Check for dangerous patterns like global.constructor.constructor
	if (node.callee.type === 'MemberExpression') {
		const memberExpr = node.callee;
		if (memberExpr.property.type === 'Identifier' && memberExpr.property.name === 'constructor') {
			throw new SecurityError('constructor access', node.loc ?? undefined, sourceCode);
		}
	}
}

/**
 * Validate a member expression.
 * @throws SecurityError if the access is dangerous
 */
export function validateMemberExpression(node: MemberExpression, sourceCode: string): void {
	// Reject dynamic property access obj[expr] (computed access)

View on GitHub (pinned to 5ac6606e81)

Solutions

1. Remove all require() calls from SDK builder code — it cannot load modules.
2. If you need a library's behavior, replicate it inline with allowed constructs, or run that logic in a Code node (Code nodes have their own module rules).
3. For data transformations, use n8n's Set node / expressions instead of a library like lodash.

Example fix

// before
const _ = require('lodash');
const merged = _.merge(a, b);

// after
const merged = { ...a, ...b };

function containsRequire(code: string): boolean {
  return /\brequire\s*\(/.test(code);
}

function usesRequire(code: string): boolean {
  return /\brequire\s*\(/.test(code);
}

import { interpretSDKCode } from '@n8n/workflow-sdk/ast-interpreter/interpreter';
import { SecurityError } from '@n8n/workflow-sdk/ast-interpreter/errors';

try {
  interpretSDKCode(code, sdkFunctions);
} catch (e) {
  if (e instanceof SecurityError && e.pattern === 'require()') {
    // hard block — builder cannot load modules
  }
  throw e;
}

When it happens

Trigger: SDK code containing `require('...')` calls — e.g., `const fs = require('fs')`, `const _ = require('lodash')`. Any CommonJS import in builder code.

Common situations: Pasting Node.js snippets that import built-ins (fs, path) or third-party libraries; attempting to share utilities via require.

Related errors

• Security violation: '${name}' is not allowed
• Security violation: 'eval()' is not allowed
• Security violation: 'Function()' is not allowed
• Security violation: 'constructor access' is not allowed
• Dynamic property access is not allowed. Use static property

AI-assisted analysis of n8n-io/n8n@5ac6606e81 (2026-08-12). Data as JSON: /api/errors/6b986baf77111543. Report an issue: GitHub.