TI-2026-00644 Aliases CVE-2026-0863 GHSA-j6wg-29xj-2fjf

Sandbox escape in n8n Python task runner allows for arbitrary code execution on the underlying host.

HIGH 76CWE-95Published 2026-01-18 · Updated 2026-01-23

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-95.

Summary

Using string formatting and exception handling, an attacker may bypass n8n's python-task-executor sandbox restrictions and run arbitrary unrestricted Python code in the underlying operating system. The vulnerability can be exploited via the Code block by an authenticated user with basic permissions and can lead to a full n8n instance takeover on instances operating under "Internal" execution mode. If the instance is operating under the "External" execution mode (ex. n8n's official Docker image) - arbitrary code execution occurs inside a Sidecar container and not the main node, which significantly reduces the vulnerability impact.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.09288 95th percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by NVD

Fix Fixed n8n: 2.4.2, 1.123.14, 2.3.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	n8n	2.4.0 to before 2.4.2; before 1.123.14; 2.0.0 to before 2.3.5	2.4.2, 1.123.14, 2.3.5	Patch available	CNA

n8n Vendor— Affected 2.4.0 to before 2.4.2; before 1.123.14; 2.0.0 to before 2.3.5 Fixed in 2.4.2, 1.123.14, 2.3.5 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:n8n:n8n::::::node.js::*	up to 1.123.14; 2.0.0 – 2.3.5; 2.4.0 – 2.4.2	Vulnerable	n8n

cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:* Versions up to 1.123.14; 2.0.0 – 2.3.5; 2.4.0 – 2.4.2 Vulnerable ·n8n

Remediation

Fix · CNA n8n Fixed in 2.4.2, 1.123.14, 2.3.5

Timeline

2026-10-02 Threatist record created from CVE-2026-0863
2026-10-03 Alias added: GHSA-j6wg-29xj-2fjf

References

Exploit 2

Patch 1

https://github.com/n8n-io/n8n/commit/b73a4283cb14e0f27ce19692326f362c7bf3da02

TI-2025-42131 n8n Vulnerable to Remote Code Execution via Expression Injection KEVCVSS 3.1CRITICAL 10.0
TI-2026-17560 n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling CVSS 3.1CRITICAL 10.0
TI-2026-01167 Authenticated users can bypass the Expression sandbox mechanism to achieve full remote… CVSS 3.1CRITICAL 9.9
TI-2025-35293 An arbitrary file upload vulnerability in the Chat Trigger component of N8N v1.95.3… CVSS 3.1HIGH 8.8
TI-2023-12275 The n8n package 0.218.0 for Node.js allows Escalation of Privileges. CVSS 3.1HIGH 8.8
TI-2023-12276 The n8n package 0.218.0 for Node.js allows Information Disclosure. CVSS 3.1HIGH 7.5

See all 178 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences