GHSA-pf2q-pxhf-hgmw: n8n: Path-Confinement Bypass in computer-use search_files Allows Reading Files Outside the Base Directory

Summary

The @n8n/computer-use file-search tool confined searches to a configured base directory. A crafted search pattern could bypass that confinement check and return the names and contents of files anywhere the daemon's OS user can read, whenever an actor could influence the tool's search input.

Mitigation

Fixed in n8n versions 2.31.5 and 2.32.1; upgrade to one of these or later. If upgrading is not immediately possible, restrict instance access to fully trusted users, disable or remove AI agent workflows that use the computer-use package, and run the n8n process under a dedicated low-privilege user account. These workarounds do not fully remediate the risk and are short-term measures only.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• n8nnpmLLM dependency since 2026-02-10

Topics

• AI agents

Related items

• MediumCVE-2026-127202: MLflow path traversal through model_id in the log outputs APISimilar attack · NVD/CVE Database
• LowAI chatbots are recommending fake retail websites, study findsSimilar attack · The Verge (AI)
• MediumPalo Alto tracks a massive Chinese AI attack that sadly lives up to industry fearsSimilar attack · CSO Online
• MediumAttackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society SectorsSimilar attack · Palo Alto Unit 42
• MediumCVE-2026-126994: braindecode model config deserialization flaw via activation argumentSimilar attack · NVD/CVE Database