Executive brief
n8n is a workflow automation platform that allows users to create and execute automated tasks. An authenticated user with workflow creation permissions can exploit a flaw in the Python Code node to escape its sandbox, enabling them to read sensitive files from the server or execute arbitrary code. On default deployments, this could lead to complete compromise of the n8n instance and access to all stored credentials and workflows.
Technical details
The vulnerability exists in n8n's Python Code node sandbox implementation, which failed to restrict access to certain built-in Python objects. An authenticated attacker with permission to create or modify workflows can leverage this to escape the sandbox. The attack vector is network-based, requiring authentication and no additional user interaction. Successful exploitation allows file read and remote code execution, with impact scope extending to other task runners in external runner configurations. The vulnerability affects versions prior to 1.123.22, 2.0.0–2.9.2, and 2.10.0. Patches are available in versions 1.123.22, 2.9.3, and 2.10.1.
Affected products
- n8n n8n all versions before 1.123.22, all versions 2.0.0-2.9.2, all versions 2.10.0
Timeline
- 2026-02-25: disclosed: Public advisory published
- 2026-02-25: patched: Fixes released in versions 1.123.22, 2.9.3, and 2.10.1