Authenticated code execution via EventEmitter prototype pollution

Code injection in the n8n Code node before 1.123.69, 2.33.4, and 2.34.1 allows remote authenticated users to execute commands via the task runner VM. The runner freezes prototypes reachable from globalThis but leaves internal module constructors such as EventEmitter mutable, so Code node JavaScript can pollute a process-wide prototype and redirect later method calls into attacker-controlled code. Exploitation requires authenticated Code node access and affects every later Code node job on the same shared runner; on v1.x deployments without task runners enabled, comparable JavaScript executes in the main n8n process instead.