CVE-2026-65590: n8n missing shell sandbox in @n8n/computer-use package

CVE-2026-65590 · Severity: medium · CVSS 4 · Published 2026-07-22

A security flaw in the n8n 'computer-use' package fails to restrict shell commands on Linux and Windows systems. While intended to run in a secure 'sandbox,' commands on these operating systems can access the entire host file system and network. This could allow an authorized user to view sensitive files or interfere with the server's internal network.

Technologies: N8n, n8n (npm). Vendors: N8n, npm.

Quick answers

Is CVE-2026-65590 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-65590 being exploited in the wild.
How severe is CVE-2026-65590?
Medium severity, with a CVSS score of 4, published 22 July 2026.
Which products and versions are affected?
N8n Computer-Use < 2.29.8, 2.30.x < 2.30.1; N8n < 2.29.8, >= 2.30.0 < 2.30.1; n8n (npm) SEMVER:introduced=2.30.0,fixed=2.30.1.
Is there a fix for CVE-2026-65590?
Yes. n8n (npm): upgrade to 2.30.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-65590 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-65590?
Check whether you run N8n Computer-Use, N8n or n8n (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • n8n (npm): upgrade to 2.30.1 or later
    npm install n8n@2.30.1

Technical details

The @n8n/computer-use package in n8n fails to implement sandboxing for its shell tool on Linux and Windows platforms, as enforcement was only active on macOS. This results in an OS Command Injection-like scenario where commands executed by the agent run with the full privileges of the n8n process. An attacker with high privileges (sufficient to trigger the computer-use agent) can achieve unrestricted read/write access to the host filesystem and reach internal network resources. The vulnerability is remediated in versions 2.29.8 and 2.30.1 by integrating 'bubblewrap' for Linux sandboxing and disabling the tool if a secure environment cannot be established.

Affected products

  • n8n-io n8n < 2.29.8, >= 2.30.0 < 2.30.1

Identifiers

  • CVE-2026-65590
  • GHSA-fpg6-x68q-5793

Timeline

  • 2026-07-08: disclosed: Initial disclosure by vendor
  • 2026-07-22: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.