I have been using this workflow for a while now and suddenly I am receiving an error. I am trying to pass inputs from Vapi in the set node field and this is the error I’m getting. [Cannot access “arguments” due to security concerns] as I mentioned I have been using this workflow and it has worked perfectly and I have changed nothing and am suddenly getting this error.
at is the error message (if any)?
[Cannot access “arguments” due to security concerns]
Just so it is understood, Vapi is sending data through a webhook to n8n, where I will use that data to update a calendar. All the information from the webhook is coming in correctly and the next step in the workflow is the Set node where you are seeing this error.
Hi @WeAdaptAI_Team Welcome to the community!
I guess instead of using arguments in your flow try passing the data directly from the vapi’s webhook , as sometimes n8n blocks arguments
This is just n8n blocking arguments because it’s a reserved JavaScript keyword, use bracket notation instead like $json.body.message.toolCalls[0].function["arguments"].full_name and it’ll work fine. Probably got caught by a security update they rolled out recently.
Yeah this is an n8n sandbox thing, it blocks arguments because it’s a reserved JS keyword. Just use bracket notation to get around it like {{ $json.body.message.toolCalls[0].function["arguments"].full_name }} and do the same for any other fields under arguments, that should fix it right up.
yes, I came to the same conclusion about arguments being the problem. I have even tried your suggestion in the past, but it still does not work. Any other suggestions would be greatly appreciated.
After reproducing your exact setup locally, I found that the easiest way to fix both problems at once is to ditch the Set node and drop a Code node right after your webhook, since it runs in a different environment that doesn’t block the keyword (screenshots attached).
Just paste this into the Code node:
const data = $input.first().json;
// safely grab the blocked keyword
const rawArgs = data.body.message.toolCalls[0].function['arguments'];
// parse the stringified json vapi sends
const parsedArgs = typeof rawArgs === 'string' ? JSON.parse(rawArgs) : rawArgs;
return {
json: {
full_name: parsedArgs.full_name
}
};
Once you run this, it parses the Vapi data and spits out a clean full_name variable. You can then drag that clean output straight into your calendar node without hitting any security errors. Let me know if that gets it running for you!
This was the exact workaround I ended up using last night. I just forgot to message in here that I came up with a workaround, and I was hoping that there was just another way. By the way, thank you A_A4 so much for taking the time to help with this solution. You’re awesome.
Okay, I made a quick fix myself by adding a new set node which makes a toJsonString() and replaces the field name “caller” to “_caller” and parseJson() again:
