Bug Description

When using the characters -> inside a workflow name, the workflow fails to save and the UI displays the following error message:

Problem saving workflow Autosave failed: Potentially malicious string Retrying in 4s...

This appears to be a false-positive validation/sanitization issue, since -> is a common sequence used in workflow naming conventions to represent flow direction.

To Reproduce

1. Open n8n.
2. Create a new workflow.
3. Rename the workflow to something containing ->.

Example: Webhook -> Process -> Send Email

1. Wait for autosave or manually save the workflow.

Expected behavior

The workflow should save successfully even when the workflow name contains the -> characters.

Debug Info

Debug info

core

• n8nVersion: 2.22.5
• platform: docker (self-hosted)
• nodeJsVersion: 24.15.0
• nodeEnv: production
• database: sqlite
• executionMode: regular
• concurrency: -1
• license: enterprise (production)
• consumerId: 49fa038a-40d9-4463-bf8d-b5d903d5bb00

storage

• success: all
• error: all
• progress: false
• manual: true
• binaryMode: filesystem

pruning

• enabled: true
• maxAge: 336 hours
• maxCount: 10000 executions

client

• userAgent: mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/148.0.0.0 safari/537.36 edg/148.0.0.0
• isTouchDevice: false

cluster

• instanceCount: 1
• versions: 2.22.5
• instances:
  • instanceKey: ea7f6ee6-6131-447e-a105-031cc200ddfc, hostId: main-4e4f2cafc1a7, instanceType: main, instanceRole: leader, version: 2.22.5
• checks:
  • check: hostid-clash, status: succeeded, warnings: -
  • check: lifecycle, status: succeeded, warnings: -
  • check: split-brain, status: succeeded, warnings: -
  • check: version-mismatch, status: succeeded, warnings: -

Generated at: 2026-05-28T11:57:08.139Z

Operating System

Ubuntu 24.01

n8n Version

2.22.5

Node.js Version

24.15.0

Database

SQLite (default)

Execution mode

main (default)

Hosting

self hosted