QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2026-0863

Back to search

CVE-2026-0863

Published: Jan 18, 2026

Modified: Jan 23, 2026

PUBLISHED

CVSS v3.1

8.5

HIGH

Description

Using string formatting and exception handling, an attacker may bypass n8n's python-task-executor sandbox restrictions and run arbitrary unrestricted Python code in the underlying operating system. The vulnerability can be exploited via the Code block by an authenticated user with basic permissions and can lead to a full n8n instance takeover on instances operating under "Internal" execution mode. If the instance is operating under the "External" execution mode (ex. n8n's official Docker image) - arbitrary code execution occurs inside a Sidecar container and not the main node, which significantly reduces the vulnerability impact.

VendorProductVersions

Unknown

n8n

affected
2.4.0 - < 2.4.2
affected
0 - < 1.123.14
affected
2.0.0 - < 2.3.5

Weaknesses (CWE)

CWE-95

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now