n8n Sandbox Escape: When Python Breaks the Wasm Wall
Jan 2, 2026·6 min read·12 visits
Executive Summary (TL;DR)
n8n versions prior to 2.0.0 implemented a Python 'Code Node' using Pyodide (Python in WebAssembly). Due to improper isolation, the Python environment retained access to the host Node.js runtime. Attackers with workflow-editing permissions can bridge this gap to execute system commands, effectively compromising the entire host and any secrets stored within n8n.
A critical sandbox bypass in the n8n workflow automation platform allows authenticated users to escape the Pyodide environment and execute arbitrary code on the host server. Rated CVSS 9.9, this vulnerability turns a standard workflow tool into a remote command execution terminal.
Official Patches
Technical Appendix
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:LAffected Systems
Affected Versions Detail
| Product | Affected Versions | Fixed Version |
|---|---|---|
n8n n8n | < 2.0.0 | 2.0.0 |
| Attribute | Detail |
|---|---|
| CWE ID | CWE-693 (Protection Mechanism Failure) |
| Attack Vector | Network (Authenticated) |
| CVSS | 9.9 (Critical) |
| Impact | Remote Command Execution (RCE) |
| Vulnerable Component | Python Code Node (Pyodide) |
| Exploit Status | Trivial for Authenticated Users |
MITRE ATT&CK Mapping
Protection Mechanism Failure
Known Exploits & Detection
Vulnerability Timeline
Subscribe to updates
Get the latest CVE analysis reports delivered to your inbox.