CVE-2026-0863

Using string formatting and exception handling, an attacker may bypass n8n's python-task-executor sandbox restrictions and run arbitrary unrestricted Python code in the underlying operating system. The vulnerability can be exploited via the Code block by an authenticated user with basic permissions and can lead to a full n8n instance takeover on instances operating under "Internal" execution mode. If the instance is operating under the "External" execution mode (ex. n8n's official Docker image) - arbitrary code execution occurs inside a Sidecar container and not the main node, which significantly reduces the vulnerability impact.

An adversary — either a compromised internal user or someone who obtained basic n8n credentials via phishing — logs into the n8n instance. They create or modify a workflow containing a Code block with Python execution enabled. Using Python's introspection capabilities (e.g., walking `__class__.__mro__` to access builtins, or exploiting string format specifiers and exception `__traceback__` chaining to escape restricted globals), they craft a payload that breaks out of the sandbox restrictions. Once outside the sandbox, they execute OS commands: first dumping `/proc/self/environ` and n8n's environment variables to harvest API keys and database credentials, then establishing a reverse shell for persistent access. On an Internal mode instance, they now own the host and can pivot to any system n8n was connected to — including production databases, cloud accounts, and LLM APIs. The entire AI automation backbone of the organization is compromised.