Executive brief
n8n is a workflow automation platform, and its computer-use package provides shell command execution capabilities. On Linux and Windows systems, this package failed to enforce security restrictions (sandboxing) that limit what shell commands can access, allowing an attacker with high privileges to read, modify, or delete files on the host system and access the network. This could lead to data breach, system compromise, or lateral movement within the network. Standard n8n deployments are unaffected; only those explicitly using the computer-use package are at risk.
Technical details
The vulnerability is an improper neutralization of OS commands (CWE-78) in the @n8n/computer-use package's shell tool. The root cause is that sandbox enforcement was implemented only for macOS; on Linux and Windows, shell commands execute without filesystem or network restrictions. An attacker with high privileges (able to interact with the n8n instance) can trigger shell command execution through the computer-use agent, gaining full access to the host filesystem and network. The attack vector is network-based, requiring high privileges and present attack requirements. Patches are available in n8n versions 2.29.8 and 2.30.1 or later, which add sandbox enforcement on Linux via bubblewrap and disable the shell tool entirely if sandboxing cannot be established. An explicit opt-out flag (--dangerously-disable-shell-sandbox) is provided for deployments requiring unsandboxed access.
Affected products
- n8n n8n < 2.29.8, 2.30.0 to < 2.30.1
- n8n @n8n/computer-use < 2.29.8, 2.30.0 to < 2.30.1
Timeline
- 2026-07-08: disclosed: GitHub security advisory published
- 2026-07-22: advisory: Duplicate advisory GHSA-4v35-78jc-648r published and subsequently withdrawn
- 2026-07-22: patched: Patches available in n8n 2.29.8 and 2.30.1