The vulnerability arises from inadequate sanitization that bypasses safeguards put in place for CVE-2025-68613. It exploits gaps in n8n's expression evaluation where crafted expressions in workflow parameters can trigger system command execution. The issue stems from a mismatch between TypeScript's compile-time type system and JavaScript's runtime behavior, allowing attackers to pass non-string values (objects, arrays, symbols) that bypass sanitization checks. Attackers can create workflows with publicly accessible webhooks and add JavaScript using destructuring syntax to execute system-level commands remotely.