GHSA-fpg6-x68q-5793: n8n: computer-use Shell Sandbox Not Enforced on Linux and Windows

Summary

GHSA-fpg6-x68q-5793 affects the shell tool in the @n8n/computer-use package, which applied its sandbox restrictions only on macOS. On Linux and Windows, shell commands ran without filesystem or network restrictions, giving unrestricted access to the host from the computer-use agent process. Only deployments that explicitly install and run @n8n/computer-use are affected, not standard n8n installations.

Mitigation

The issue is fixed in n8n versions 2.29.8 and 2.30.1; upgrade to one of these or later. The fix adds sandbox enforcement on Linux via bubblewrap and disables the shell tool when a working sandbox cannot be established. The opt-out flag --dangerously-disable-shell-sandbox exists for deployments that require unsandboxed shell access. Temporary workarounds: avoid deploying @n8n/computer-use on Linux or Windows hosts until the fix is applied, and restrict access to the n8n instance and computer-use agent to fully trusted users. The source states these workarounds do not fully remediate the risk.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• n8nnpmLLM dependency since 2026-02-10

Topics

• AI agents

Related items

• HighCVE-2026-67547: taOS remote code execution via skill-exec endpoint for non-admin usersSimilar attack · NVD/CVE Database
• MediumCVE-2026-65957: Helio dashboard CORS origin validation bypass via private-network prefix matchSimilar attack · NVD/CVE Database
• Mediumllm 0.37.2Similar attack · Simon Willison's Weblog
• MediumAntiFox AI Pentesting Platform Linked to Attacks That Accessed AWS Production SecretsSimilar attack · The Hacker News
• MediumHackers use AntiFox AI agents in AWS credential-theft attacksSimilar attack · BleepingComputer