Sign in
Deutsch English Español Polski
Critical

n8n has a Python sandbox escape

  • Disclosed: 04.02.2026
  • Updated: 11.10.2026 10:22

Impact

A vulnerability in the Python Code node allows authenticated users to break out of the Python sandbox environment and execute code outside the intended security boundary.

Only authenticated users are able to execute code through Task Runners.

This issue affected any deployment in which the following conditions were met:

  • Task Runners were enabled using N8N_RUNNERS_ENABLED=true (default: false)
  • Python was enabled N8N_PYTHON_ENABLED=true
  • Code Node was enabled (default: true)

In case the N8N_RUNNERS_MODE is set to external (default: internal) the sandbox escape is limited to the sidecar container with lower risk for lateral movement. In that case a lower high severity is more appropriate.

Patches

This vulnerability is fixed in version 2.4.8 and later.

Workarounds

If an immediate upgrade cannot be applied, the following hardening steps are recommended:

  • Disable the Code Node by adding n8n-nodes-base.code to the NODES_EXCLUDE environment variable
  • Prefer external mode for isolation: run Task Runners in external mode so that untrusted task code executes in a separate sidecar container rather than within the main n8n process. This configuration significantly reduces the risk of in-process memory disclosure caused by unsafe buffer allocations.In external mode, a launcher manages Task Runner processes in a dedicated sidecar environment, separate from the primary n8n instance. See the [n8n documentation](https://docs.n8n.io/hosting/configuration/task-runners/) for configuration details and required environment variables.

Resources

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package n8n < 2.4.8 2.4.8

References

CVSS score 9.9/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness (CWE)
CWE-693
Platform
npm
Package
n8n
Disclosed
04.02.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-8398-gmmx-564h - CC BY 4.0

Vulnerability history: n8n

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (156) in the archive
Total entries
156
First → latest
05.2023 09.2026
Without a fix
1
Exploited in attacks
1

Severity breakdown

  • Critical 24
  • High 58
  • Medium 74

Disclosures per year

Severity:
  1. n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Execution
    High CVE-2026-86083 < 1.123.76, >= 2.38.0, < 2.38.2, >= 2.0.0, < 2.37.7 1.123.76, 2.38.2, 2.37.7
  2. n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node
    High CVE-2026-86082 < 1.123.76, >= 2.38.0, < 2.38.2, >= 2.0.0, < 2.37.7 1.123.76, 2.38.2, 2.37.7
  3. n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path
    High CVE-2026-86081 < 1.123.76, >= 2.38.0, < 2.38.2, >= 2.0.0, < 2.37.7 1.123.76, 2.38.2, 2.37.7
  4. n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint
    High CVE-2026-86075 >= 2.38.0, < 2.38.2, < 2.37.7 2.38.2, 2.37.7
  5. n8n: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code Execution
    High CVE-2026-86076 < 1.123.76, >= 2.38.0, < 2.38.2, >= 2.0.0, < 2.37.7 1.123.76, 2.38.2, 2.37.7
  6. n8n: Prototype Pollution via Dot-Notation Field Names Leads To Instance-Wide Denial of Service
    High CVE-2026-72749 < 1.123.67, >= 2.32.0, < 2.32.1, >= 2.0.0-rc.0, < 2.31.5 1.123.67, 2.32.1, 2.31.5
  7. n8n: Edit Image Node Format Injection Allows Arbitrary File Write
    High CVE-2026-72762 < 1.123.67, >= 2.32.0, < 2.32.1, >= 2.0.0-rc.0, < 2.31.5 1.123.67, 2.32.1, 2.31.5
  8. n8n: Shared-Workflow Editor Can Exfiltrate Credentials via Inline Sub-Workflow JSON
    High CVE-2026-72763 < 1.123.67, >= 2.32.0, < 2.32.1, >= 2.0.0-rc.0, < 2.31.5 1.123.67, 2.32.1, 2.31.5
  9. n8n: Credential Authorization Bypass via Expression in HTTP Request Node `genericAuthType`
    High CVE-2026-72774 < 1.123.67, >= 2.32.0, < 2.32.1, >= 2.0.0-rc.0, < 2.31.5 1.123.67, 2.32.1, 2.31.5
  10. n8n: Expression sandbox escape via arrow-function bodies enabling command execution
    High CVE-2026-72765 >= 2.32.0, < 2.32.1, < 2.31.5 2.32.1, 2.31.5
  11. n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion
    High CVE-2026-72766 < 1.123.67, >= 2.32.0, < 2.32.1, >= 2.0.0-rc.0, < 2.31.5 1.123.67, 2.32.1, 2.31.5
  12. n8n: Authenticated code execution in the n8n Git node
    High CVE-2026-72767 < 1.123.67, >= 2.32.0, < 2.32.1, >= 2.0.0-rc.0, < 2.31.5 1.123.67, 2.32.1, 2.31.5
  13. n8n: Git Node fetch/pull/pushTags Operations Bypass Sandbox Path Restriction
    High CVE-2026-72770 < 1.123.67, >= 2.32.0, < 2.32.1, >= 2.0.0-rc.0, < 2.31.5 1.123.67, 2.32.1, 2.31.5
  14. n8n: Bypass "Allowed HTTP Request Domains" Credential Restriction in Multiple AI and LLM Nodes
    High CVE-2026-72771 >= 2.32.0, < 2.32.1, < 2.31.5 2.32.1, 2.31.5
  15. n8n: Account Takeover via Unverified Email Claim in Token Exchange Embed Login
    High CVE-2026-72772 >= 2.32.0, < 2.32.1, < 2.31.5 2.32.1, 2.31.5
  16. n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner
    High CVE-2026-65016 < 1.123.64, >= 2.30.0, < 2.30.1, >= 2.0.0-rc.0, < 2.29.8 1.123.64, 2.30.1, 2.29.8
  17. n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution
    High CVE-2026-65591 < 1.123.64, >= 2.30.0, < 2.30.1, >= 2.0.0-rc.0, < 2.29.8 1.123.64, 2.30.1, 2.29.8
  18. n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs
    High CVE-2026-65595 >= 2.30.0, < 2.30.1, < 2.29.8 2.30.1, 2.29.8
  19. n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution
    High CVE-2026-59208 >= 2.28.0, < 2.28.1, < 2.27.4 2.28.1, 2.27.4
  20. n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector
    High CVE-2026-59207 >= 2.28.0, < 2.28.1, < 2.27.4 2.28.1, 2.27.4
  21. n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration
    High CVE-2026-59206 < 1.123.61, >= 2.28.0, < 2.28.1, >= 2.0.0-rc.0, < 2.27.4 1.123.61, 2.28.1, 2.27.4
  22. n8n: Shared Credential Header Leak via HTTP Request Pagination Expression
    High CVE-2026-59209 < 1.123.61, >= 2.28.0, < 2.28.1, >= 2.0.0-rc.0, < 2.27.4 1.123.61, 2.28.1, 2.27.4
  23. n8n: Stored DOM XSS via Resource Locator `cachedResultUrl`
    High CVE-2026-65592 < 1.123.64, >= 2.30.0, < 2.30.1, >= 2.0.0-rc.0, < 2.29.8 1.123.64, 2.30.1, 2.29.8
  24. n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview
    High CVE-2026-65597 < 1.123.64, >= 2.30.0, < 2.30.1, >= 2.0.0-rc.0, < 2.29.8 1.123.64, 2.30.1, 2.29.8
  25. n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution
    High CVE-2026-65598 < 1.123.64, >= 2.30.0, < 2.30.1, >= 2.0.0-rc.0, < 2.29.8 1.123.64, 2.30.1, 2.29.8
  26. n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool
    High CVE-2026-65015 >= 2.30.0, < 2.30.1, < 2.29.8 2.30.1, 2.29.8
  27. n8n: SecurityScorecard Node Leaks API Token to User-Controlled Host
    High · 7.7 CVE-2026-54304 < 1.123.55, >= 2.26.0, < 2.26.1, >= 2.0.0-rc.0, < 2.25.7 1.123.55, 2.26.1, 2.25.7
  28. n8n: MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions
    High · 10.0 CVE-2026-54309 >= 2.26.0, < 2.26.2, < 2.25.7 2.26.2, 2.25.7
  29. n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints
    High · 9.9 CVE-2026-54305 < 1.123.55, >= 2.26.0, < 2.26.2, >= 2.0.0-rc.0, < 2.25.7 1.123.55, 2.26.2, 2.25.7
  30. n8n: Credential Exfiltration via Permission Bypass
    High · 9.6 CVE-2026-54307 < 1.123.55, >= 2.26.0, < 2.26.2, >= 2.0.0-rc.0, < 2.25.7 1.123.55, 2.26.2, 2.25.7
  31. n8n: Stored XSS in Chat Trigger Node
    High · 7.6 CVE-2026-54302 < 1.123.55, >= 2.26.0, < 2.26.2, >= 2.0.0-rc.0, < 2.25.7 1.123.55, 2.26.2, 2.25.7
  32. n8n: Microsoft SQL Node Prototype Pollution
    High · 8.5 CVE-2026-54312 < 2.24.0 2.24.0
  33. n8n: Same-Origin XSS in Respond to Webhook Node
    High · 7.6 CVE-2026-54301 < 1.123.55, >= 2.26.0, < 2.26.2, >= 2.0.0-rc.0, < 2.25.7 1.123.55, 2.26.2, 2.25.7
  34. n8n: Python sandbox escape
    High · 8.5 CVE-2026-49444 < 1.123.48, >= 2.22.0, < 2.22.4, >= 2.0.0-rc.0, < 2.21.8 1.123.48, 2.22.4, 2.21.8
  35. n8n Has a Cross-user Authorization Bypass in Dynamic Credential OAuth Endpoints
    High · 8.1 CVE-2026-45732 < 1.123.43, >= 2.21.0, < 2.21.1, >= 2.0.0-rc.0, < 2.20.7 1.123.43, 2.21.1, 2.20.7
  36. n8n Has a Source Control Pull SQL Injection
    High · 9.0 CVE-2026-44792 < 1.123.43, >= 2.21.0, < 2.21.1, >= 2.0.0-rc.0, < 2.20.7 1.123.43, 2.21.1, 2.20.7
  37. n8n Has an XML Node Prototype Pollution Patch Bypass
    Critical · 9.9 CVE-2026-44791 < 1.123.43, >= 2.21.0, < 2.22.1, >= 2.0.0-rc.0, < 2.20.7 1.123.43, 2.22.1, 2.20.7
  38. n8n Has an Arbitrary File Read via Git Node
    Critical · 8.8 CVE-2026-44790 < 1.123.43, >= 2.21.0, < 2.22.1, >= 2.0.0-rc.0, < 2.20.7 1.123.43, 2.22.1, 2.20.7
  39. n8n: HTTP Request Node Pagination Prototype Pollution to RCE
    Critical · 9.9 CVE-2026-44789 < 1.123.43, >= 2.21.0, < 2.22.1, >= 2.0.0-rc.0, < 2.20.7 1.123.43, 2.22.1, 2.20.7
  40. n8n has XML Node Prototype Pollution that to RCE
    Critical · 9.9 CVE-2026-42232 >= 2.18.0, < 2.18.1, >= 2.17.0, < 2.17.4, < 1.123.32 2.18.1, 2.17.4, 1.123.32
  41. n8n has Prototype Pollution in XML Webhook Body Parser that Leads to RCE
    Critical · 10.0 CVE-2026-42231 < 1.123.32, >= 2.18.0, < 2.18.1, >= 2.17.0, < 2.17.4 1.123.32, 2.18.1, 2.17.4
  42. n8n Vulnerable to XSS via MCP OAuth client
    High · 8.2 CVE-2026-42235 < 1.123.32, >= 2.18.0, < 2.18.1, >= 2.17.0, < 2.17.4 1.123.32, 2.18.1, 2.17.4
  43. n8n's Credential Authorization Bypass in dynamic-node-parameters Allows Foreign API Key Replay
    High · 8.5 CVE-2026-42226 >= 2.17.0, < 2.17.5, < 1.123.33 2.17.5, 1.123.33
  44. n8n has a Python Task Runner Sandbox Escape Vulnerability
    High · 7.5 CVE-2026-42234 < 1.123.32, >= 2.18.0, < 2.18.1, >= 2.17.0, < 2.17.4 1.123.32, 2.18.1, 2.17.4
  45. n8n Vulnerable to Unauthenticated Denial of Service via MCP Client Registration
    High · 7.5 CVE-2026-42236 < 1.123.32, >= 2.18.0, < 2.18.1, >= 2.0.0, < 2.17.4 1.123.32, 2.18.1, 2.17.4
  46. n8n has SQL Injection in Data Table Node via orderByColumn Expression
    High · 9.9 CVE-2026-33713 < 1.123.26, >= 2.14.0, < 2.14.1, >= 2.0.0-rc.0, < 2.13.3 1.123.26, 2.14.1, 2.13.3
  47. n8n: Prototype Pollution in XML and GSuiteAdmin node parameters lead to RCE
    Critical · 9.9 CVE-2026-33696 >= 2.14.0, < 2.14.1, >= 2.0.0-rc.0, < 2.13.3, < 1.123.27 2.14.1, 2.13.3, 1.123.27
  48. n8n Has External Secrets Authorization Bypass in Credential Saving
    High · 6.3 CVE-2026-33722 < 1.123.23, >= 2.0.0-rc.0, < 2.6.4 1.123.23, 2.6.4
  49. n8n: LDAP Email-Based Account Linking Allows Privilege Escalation and Account Takeover
    High · 8.2 CVE-2026-33665 >= 2.0.0-rc.0, < 2.4.0, < 1.121.0 2.4.0, 1.121.0
  50. n8n is Vulnerable to Credential Theft via Name-Based Resolution and Permission Checker Bypass in Community Edition
    High · 9.9 CVE-2026-33663 < 1.123.27, >= 2.14.0, < 2.14.1, >= 2.0.0-rc.0, < 2.13.3 1.123.27, 2.14.1, 2.13.3
  51. n8n has Multiple Remote Code Execution Vulnerabilities in Merge Node AlaSQL SQL Mode
    Critical · 9.9 CVE-2026-33660 >= 2.14.0, < 2.14.1, >= 2.0.0-rc.0, < 2.13.3, < 1.123.27 2.14.1, 2.13.3, 1.123.27
  52. n8n has In-Process Memory Disclosure in its Task Runner
    High · 6.5 CVE-2026-27496 < 1.123.22, >= 2.10.0, < 2.10.1, >= 2.0.0-rc.0, < 2.9.3 1.123.22, 2.10.1, 2.9.3
  53. n8n Vulnerable to Stored XSS via Various Nodes
    High · 5.4 CVE-2026-27578 < 1.123.22, >= 2.0.0, < 2.9.3, >= 2.10.0, < 2.10.1 1.123.22, 2.9.3, 2.10.1
  54. n8n: Expression Sandbox Escape Leads to RCE
    Critical · 9.9 CVE-2026-27577 < 1.123.22, >= 2.0.0, < 2.9.3, >= 2.10.0, < 2.10.1 1.123.22, 2.9.3, 2.10.1
  55. n8n has Arbitrary Command Execution via File Write and Git Operations
    Critical · 8.5 CVE-2026-27498 < 1.123.8, >= 2.0.0, < 2.2.0 1.123.8, 2.2.0
  56. n8n has Potential Remote Code Execution via Merge Node
    Critical · 9.9 CVE-2026-27497 < 1.123.22, >= 2.0.0, < 2.9.3, >= 2.10.0, < 2.10.1 1.123.22, 2.9.3, 2.10.1
  57. n8n has a Sandbox Escape in its JavaScript Task Runner
    Critical CVE-2026-27495 < 1.123.22, >= 2.0.0, < 2.9.3, >= 2.10.0, < 2.10.1 1.123.22, 2.9.3, 2.10.1
  58. n8n has Arbitrary File Read via Python Code Node Sandbox Escape
    High · 9.9 CVE-2026-27494 < 1.123.22, >= 2.0.0, < 2.9.3, >= 2.10.0, < 2.10.1 1.123.22, 2.9.3, 2.10.1
  59. n8n has Unauthenticated Expression Evaluation via Form Node
    Critical · 9.0 CVE-2026-27493 < 1.123.22, >= 2.0.0, < 2.9.3, >= 2.10.0, < 2.10.1 1.123.22, 2.9.3, 2.10.1
  60. n8n has a Python sandbox escape this entry
    Critical · 9.9 CVE-2026-25115 < 2.4.8 2.4.8
Show more (20) Showing 60 of 82

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.