CVEReports
CVEReports

Automated vulnerability intelligence platform. Comprehensive reports for high-severity CVEs generated by AI.

Product

  • Home
  • Sitemap
  • RSS Feed

Company

  • About
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CVEReports. All rights reserved.

Made with love by Amit Schendel & Alon Barad

CVE-2025-68668

n8n Sandbox Escape: When Python Breaks the Wasm Wall

Alon Barad
Alon Barad
Software Engineer

Jan 2, 2026·6 min read·124 visits

Executive Summary (TL;DR)

n8n versions prior to 2.0.0 implemented a Python 'Code Node' using Pyodide (Python in WebAssembly). Due to improper isolation, the Python environment retained access to the host Node.js runtime. Attackers with workflow-editing permissions can bridge this gap to execute system commands, effectively compromising the entire host and any secrets stored within n8n.

A critical sandbox bypass in the n8n workflow automation platform allows authenticated users to escape the Pyodide environment and execute arbitrary code on the host server. Rated CVSS 9.9, this vulnerability turns a standard workflow tool into a remote command execution terminal.

Official Patches

n8nn8n v2.0.0 Release Notes
n8nGitHub Security Advisory

Technical Appendix

CVSS Score
9.9/ 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
EPSS Probability
0.10%
Top 100% most exploited
5,000
via Shodan

Affected Systems

n8n workflow automation platform (versions < 2.0.0)

Affected Versions Detail

Product
Affected Versions
Fixed Version
n8n
n8n
< 2.0.02.0.0
AttributeDetail
CWE IDCWE-693 (Protection Mechanism Failure)
Attack VectorNetwork (Authenticated)
CVSS9.9 (Critical)
ImpactRemote Command Execution (RCE)
Vulnerable ComponentPython Code Node (Pyodide)
Exploit StatusTrivial for Authenticated Users

MITRE ATT&CK Mapping

T1059.006Command and Scripting Interpreter: Python
Execution
T1611Escape to Host
Privilege Escalation
T1552Unsecured Credentials
Credential Access
CWE-693
Protection Mechanism Failure

Protection Mechanism Failure

Known Exploits & Detection

Research AnalysisThe vendor advisory confirms the sandbox bypass via Pyodide.

Vulnerability Timeline

Vulnerability disclosed
2025-01-15
n8n v2.0.0 released with fix
2025-01-20

References & Sources

  • [1]GHSA-62r4-hw23-cc8v: Sandbox Bypass in Python Code Node

Attack Flow Diagram

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

More Reports

•21 minutes ago•CVE-2026-55619
5.3

CVE-2026-55619: Parser Denial of Service via Deeply Nested Parentheses in E-mail Headers

A denial of service vulnerability in GOVCERT-LU eml_parser before version 3.0.2 allows unauthenticated remote attackers to trigger an unhandled RecursionError exception. The issue arises during the parsing of structured email headers containing excessively nested parentheses representing Comments and Folding White Space (CFWS). Because the parser fails to catch this recursion-limit exception from Python's standard library, processing of the entire mail immediately aborts, which can disrupt automated security triage pipelines and email ingestion components.

Alon Barad
Alon Barad
1 views•6 min read
•about 1 hour ago•CVE-2026-55620
7.5

CVE-2026-55620: Algorithmic Complexity Denial of Service in GOVCERT-LU eml_parser

Prior to version 3.0.2, GOVCERT-LU's eml_parser library is vulnerable to an algorithmic complexity Denial of Service (DoS) vulnerability via the comment-stripping routine noparenthesis() in routing.py. An unauthenticated attacker can submit a crafted EML file containing nested parenthesized comments to cause complete CPU saturation. This happens due to a quadratic time complexity bottleneck in regex replacement of nested structures.

Amit Schendel
Amit Schendel
2 views•6 min read
•about 2 hours ago•CVE-2026-55629
8.7

CVE-2026-55629: Arbitrary File Read via Path Traversal in Whistle Proxy Internal Service

Whistle prior to version 2.10.3 contains a path traversal vulnerability in its internal service layer. An unauthenticated remote attacker can read arbitrary files on the hosting operating system by issuing a crafted GET request containing relative or absolute file paths to the `/cgi-bin/temp/get` endpoint. This behavior occurs because the application fails open when an input file parameter does not match the temporary file format regex.

Alon Barad
Alon Barad
3 views•6 min read
•about 3 hours ago•CVE-2026-55609
7.1

CVE-2026-55609: Arbitrary File Read and Write via Model Context Protocol (MCP) Tools in sublinear-time-solver and consciousness-explorer

An arbitrary file read and write vulnerability exists in the Model Context Protocol (MCP) server endpoints of sublinear-time-solver and consciousness-explorer. By providing unvalidated file paths to the export_state, import_state, saveVectorToFile, and loadVectorFromFile tools, local attackers can read or overwrite sensitive host files.

Alon Barad
Alon Barad
2 views•5 min read
•about 4 hours ago•CVE-2026-55604
8.6

CVE-2026-55604: Authorization Bypass via Global Session Singleton in @arikusi/deepseek-mcp-server

An Authorization Bypass Through User-Controlled Key (CWE-639 / Insecure Direct Object Reference) vulnerability exists in @arikusi/deepseek-mcp-server starting in version 1.4.2 and fixed in 1.7.0. In Streamable HTTP transport mode, a process-global SessionStore singleton allows any remote client to retrieve or modify active conversation contexts belonging to other clients.

Alon Barad
Alon Barad
7 views•7 min read
•about 5 hours ago•CVE-2026-45018
9.8

CVE-2026-45018: Unauthenticated Remote Code Execution via MCP stdio Transport in Chainlit

CVE-2026-45018 is a critical command injection vulnerability in Chainlit's Model Context Protocol (MCP) stdio transport backend. By submitting a crafted JSON payload containing dangerous argument options to an unauthenticated HTTP endpoint, a remote attacker can bypass executable validation rules and run arbitrary shell commands with the privileges of the active Python process.

Alon Barad
Alon Barad
6 views•10 min read