GHSA-9pq8-m8gp-4p53: n8n: Python sandbox escape

Summary

An authenticated user with permission to create or modify workflows containing a Python Code Node could escape the sandbox and achieve arbitrary code execution on the task runner container. The issue affects only n8n instances where the Python Task Runner is enabled.

Mitigation

The issue has been fixed in n8n versions 1.123.48, 2.21.8, and 2.22.4; users should upgrade to one of these versions or later. If upgrading is not immediately possible, limit workflow creation and editing permissions to fully trusted users only, and disable the Python Code node by adding `n8n-nodes-base.code` to the `NODES_EXCLUDE` environment variable, or disable the Python Task Runner entirely. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• n8nnpmDeclares an LLM dependency

Related items

• MediumCVE-2026-122235: Jan workspace guard bypass allows file writes outside workspace via symlinksSimilar attack · NVD/CVE Database
• HighCVE-2026-122135: Mistral Vibe remote code execution via repository gpg.program settingSimilar attack · NVD/CVE Database
• HighCVE-2026-122134: Mistral Vibe remote code execution through malicious Git filter driversSimilar attack · NVD/CVE Database
• HighCVE-2026-122133: Mistral Vibe untrusted search path code execution via git.exe on WindowsSimilar attack · NVD/CVE Database
• MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database