Critical · published February 4, 2026
🚨 An authenticated user can escape the Python sandbox, making this vulnerability a major headache! 🔥 Think of it like a magician who’s supposed to only perform tricks on stage but finds a way to access the backstage area and pull off even more dangerous illusions. Once they’re out of bounds, the consequences can be quite severe! An attacker could execute arbitrary code outside the intended environment, potentially compromising the entire system. This could lead to unauthorized access, data manipulation, or even a complete takeover of the automation server. It's absolutely devastating!
Think of it like a magician who’s supposed to only perform tricks on stage but finds a way to access the backstage area and pull off even more dangerous illusions. Once they’re out of bounds, the consequences can be quite severe! The flaw exists in the Python Code node of n8n prior to version 2.4.8, allowing authenticated users to break out of the sandbox environment and execute code freely, bypassing security restrictions.
An attacker could execute arbitrary code outside the intended environment, potentially compromising the entire system. This could lead to unauthorized access, data manipulation, or even a complete takeover of the automation server. It's absolutely devastating! Upgrade to n8n version 2.4.8 or later immediately to close this security gap. Ensure that your workflow automation processes are restricted to trusted users only to minimize risks. Regularly review user permissions and access controls! You've got this! With just a quick update, you'll reinforce your defenses in no time. 🛡️