PT-2026-3396 · N8N · N8N

Natan Nehorai · Publicado 2026-01-18 · Atualizado 2026-03-10 · CVE-2026-0863

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.14 n8n versions prior to 2.3.5 n8n versions prior to 2.4.2

Description An issue exists in n8n that allows an attacker to bypass the python-task-executor sandbox restrictions. This bypass is achieved through the use of string formatting and exception handling, enabling the execution of arbitrary unrestricted Python code in the underlying operating system. The vulnerability can be exploited by an authenticated user with basic permissions via the Code block. In instances operating under "Internal" execution mode, a full n8n instance takeover is possible. If the instance operates under "External" execution mode, arbitrary code execution occurs within a Sidecar container, reducing the impact. The vulnerability is related to a Python 3.10 error-handling feature that bypasses static analysis. The vulnerability is exploitable through the use of f-strings and the traceback object.

Recommendations Update n8n to version 1.123.14 or later. Update n8n to version 2.3.5 or later. Update n8n to version 2.4.2 or later.

Exploit

Correção

RCE

Eval Injection

Code Injection

Enumeração de Fraquezas

CWE-95

CWE-94

Identificadores relacionados

CVE-2026-0863

Produtos afetados

N8N

Referências · 33

• 🔥 https://research.jfrog.com/vulnerabilities/n8n-python-runner-sandbox-escape-jfsa-2026-001651077 · Exploit
• 🔥 https://smartkeyss.com/post/cve-2026-0863-python-sandbox-escape-in-n8n-via-exception-formatting-and-implicit-code-execution · Exploit
• https://github.com/n8n-io/n8n/commit/b73a4283cb14e0f27ce19692326f362c7bf3da02 · Correção
• https://twitter.com/Zeroverse_ai/status/2013450931380331021 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2012915772159320420 · Publicação no Twitter
• https://twitter.com/probablypwned/status/2016919510142370074 · Publicação no Twitter
• https://twitter.com/GoPlusSecurity/status/2016814674445255032 · Publicação no Twitter
• https://twitter.com/TweetThreatNews/status/2017259060626596110 · Publicação no Twitter
• https://twitter.com/threatcluster/status/2017030166703194443 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-0863 · Nota de Segurança
• https://twitter.com/_cvereports/status/2013409312677208246 · Publicação no Twitter
• https://t.me/EchelonEyes/4309 · Publicação no Telegram
• https://twitter.com/autumn_good_35/status/2016562101884768318 · Publicação no Twitter
• https://twitter.com/securityblvd/status/2018693457401839936 · Publicação no Twitter
• https://twitter.com/socradar/status/2016843768935415935 · Publicação no Twitter