n8n read an unchecked array property across its expression sandbox boundary. The repair restricts access to valid array indices and checks returned values before crossing the boundary.

@@ -0,0 +321,18 @@+				}++				if (!Array.isArray(arr)) {+					return undefined;+				}++				const element = arr[index];++				// If element is object/array, return metadata+				if (element !== null && typeof element === 'object') {

+					if (Array.isArray(element)) {+						const smallArrayThreshold = 100;+						return {+							__isArray: true,+							__length: element.length,+							__data: element.length <= smallArrayThreshold ? element : null,+						};+					}

@@ -400,5 +400,18 @@ 					return undefined; 				} +				// Only genuine array indices are reachable; anything else (e.g.+				// 'constructor', '__lookupGetter__') would read off the prototype+				// chain and could leak a host function reference across the boundary.+				if (!Number.isInteger(index) || index < 0) {+					return undefined;+				}+

 				const element = arr[index]; +				// Functions are never reachable through the data surface — mirror the+				// guard in getValueAtPath so a host callable can't cross the boundary.+				if (typeof element === 'function') {+					return undefined;+				}+