Critical Arbitrary Command Execution Vulnerability in n8n Package
Summary
GHSA-62r4-hw23-cc8v: n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Node. Affects n8n versions >= 1.0.0, < 2.0.0. Fixed in 2.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
n8n is an open-source workflow automation tool that allows users to connect various applications and services to automate tasks. It features a visual interface for creating workflows, supports numerous integrations, and enables users to write custom code using the Code Node. However, a vulnerability exists in the Python Code Node that utilizes Pyodide, which can lead to serious security risks.
Vulnerability Detail
A sandbox bypass vulnerability exists in the Python Code Node that uses Pyodide. An authenticated user with permission to create or modify workflows can exploit this vulnerability to execute arbitrary commands on the host system running n8n, using the same privileges as the n8n process. This vulnerability is classified under CWE-693 and has a CVSS score of 9.9, indicating a critical severity level.
How To Fix
Latest published version: 2.44.6 as of 22 Oct 2026
npm install n8n@2.44.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0.0
This is the first release that contains the fix.
npm install n8n@2.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not possible, consider the following workarounds:
- Disable the Code Node by setting the environment variable: NODES_EXCLUDE: '["n8n-nodes-base.code"]'.
- Disable Python support in the Code Node by setting the environment variable: N8N_PYTHON_ENABLED=false.
- Configure n8n to use the task runner based Python sandbox via the environment variables: N8N_RUNNERS_ENABLED and N8N_NATIVE_PYTHON_RUNNER.
Conclusion
The n8n package has a critical vulnerability that allows for arbitrary command execution through the Python Code Node. Users are strongly advised to update to the latest version or implement the suggested workarounds to mitigate risks. Regular monitoring for vulnerabilities using tools like Vulert is also recommended.
See every vulnerability recorded for n8n →
FAQ
The vulnerability allows authenticated users to execute arbitrary commands on the host system running n8n, potentially compromising the system's security.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized access, data breaches, and complete control over the host system running n8n.
Yes, updating to n8n version 2.0.0 or later addresses this vulnerability by introducing a more secure Python implementation.
You can implement workarounds such as disabling the Code Node or Python support in the Code Node until you can update.
References
Related vulnerabilities
Recent vulnerabilities recorded for n8n.
