# Scan n8n Code nodes and expressions for injection

**Use case:** 

Check the JavaScript and expressions inside a workflow, not just its node settings. Flags expressions reaching for the host runtime through a constructor chain, process.env, require() or globalThis (the pattern behind CVE-2025-68613), values interpolated into an Execute Query field instead of query parameters, and Code nodes calling the network with no credential governing the traffic.

## Input

```json
{
  "workflowJson": {
    "name": "Support ticket triage",
    "nodes": [
      {
        "id": "1",
        "name": "Ticket created",
        "type": "n8n-nodes-base.webhook",
        "typeVersion": 2,
        "position": [
          0,
          0
        ],
        "parameters": {
          "path": "tickets",
          "httpMethod": "POST",
          "authentication": "headerAuth"
        },
        "credentials": {
          "httpHeaderAuth": {
            "id": "2",
            "name": "Webhook header auth"
          }
        }
      },
      {
        "id": "2",
        "name": "Enrich in Code",
        "type": "n8n-nodes-base.code",
        "typeVersion": 2,
        "position": [
          240,
          0
        ],
        "parameters": {
          "jsCode": "const res = await fetch('https://enrichment.internal/api/lookup?email=' + $json.email);\nconst data = await res.json();\nreturn [{ json: { ...$json, company: data.company } }];"
        }
      },
      {
        "id": "3",
        "name": "Find matching account",
        "type": "n8n-nodes-base.postgres",
        "typeVersion": 2.4,
        "position": [
          480,
          0
        ],
        "parameters": {
          "operation": "executeQuery",
          "query": "=SELECT id, plan FROM accounts WHERE email = '{{ $json.email }}' AND company = '{{ $json.company }}'",
          "options": {}
        },
        "credentials": {
          "postgres": {
            "id": "5",
            "name": "Postgres account"
          }
        }
      },
      {
        "id": "4",
        "name": "Build routing key",
        "type": "n8n-nodes-base.set",
        "typeVersion": 3.4,
        "position": [
          720,
          0
        ],
        "parameters": {
          "assignments": {
            "assignments": [
              {
                "id": "a",
                "name": "queue",
                "type": "string",
                "value": "={{ $json.constructor.constructor('return process.env.QUEUE_NAME')() }}"
              }
            ]
          }
        }
      },
      {
        "id": "5",
        "name": "Push to queue",
        "type": "n8n-nodes-base.httpRequest",
        "typeVersion": 4.2,
        "position": [
          960,
          0
        ],
        "parameters": {
          "url": "=https://queue.internal/{{ $json.queue }}",
          "method": "POST",
          "options": {
            "timeout": 10000
          }
        }
      }
    ],
    "connections": {
      "Ticket created": {
        "main": [
          [
            {
              "node": "Enrich in Code",
              "type": "main",
              "index": 0
            }
          ]
        ]
      },
      "Enrich in Code": {
        "main": [
          [
            {
              "node": "Find matching account",
              "type": "main",
              "index": 0
            }
          ]
        ]
      },
      "Find matching account": {
        "main": [
          [
            {
              "node": "Build routing key",
              "type": "main",
              "index": 0
            }
          ]
        ]
      },
      "Build routing key": {
        "main": [
          [
            {
              "node": "Push to queue",
              "type": "main",
              "index": 0
            }
          ]
        ]
      }
    },
    "settings": {
      "errorWorkflow": "err-1"
    }
  },
  "workflowUrls": [],
  "workflowIds": [],
  "activeOnly": false,
  "ruleSet": "security",
  "minSeverity": "medium",
  "ignoreRules": [],
  "includeReport": false
}
```

## Output

```json
{
  "severity": {
    "label": "Severity",
    "format": "string"
  },
  "rule": {
    "label": "Rule ID",
    "format": "string"
  },
  "ruleTitle": {
    "label": "Rule",
    "format": "string"
  },
  "category": {
    "label": "Category",
    "format": "string"
  },
  "workflowName": {
    "label": "Workflow",
    "format": "string"
  },
  "nodeName": {
    "label": "Node",
    "format": "string"
  },
  "nodeType": {
    "label": "Node type",
    "format": "string"
  },
  "message": {
    "label": "Finding",
    "format": "string"
  },
  "parameterPath": {
    "label": "Parameter",
    "format": "string"
  },
  "evidence": {
    "label": "Evidence (masked)",
    "format": "string"
  },
  "remediation": {
    "label": "How to fix",
    "format": "string"
  },
  "docsUrl": {
    "label": "Docs",
    "format": "string"
  }
}
```

## About this Actor

This example demonstrates how to use [n8n Workflow Auditor - Linter & Security Review](https://apify.com/mediocre_interest/n8n-workflow-auditor.md) with a specific input configuration. Visit the [Actor detail page](https://apify.com/mediocre_interest/n8n-workflow-auditor.md) to learn more, explore other use cases, and run it yourself.


## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
This Task's input is already configured above — use it as-is rather than inventing a new one.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For full API examples (JavaScript, Python, CLI, MCP, OpenAPI), see this Task's Actor page: https://apify.com/mediocre_interest/n8n-workflow-auditor.md

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).