by Kastro
Paper/Archive/CVE-2026-25115

CVE-2026-25115

n8n-io n8n — n8n is vulnerable to Python sandbox escape

EPSS 0.6%CVSS 9.9
critical.is priorityof 100
39
CVSS 9.9 (NVD)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 47.6.476 × 209.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

n8n is an open source workflow automation platform. Prior to version 2.4.8, a vulnerability in the Python Code node allows authenticated users to break out of the Python sandbox environment and execute code outside the intended security boundary. This issue has been patched in version 2.4.8.

Affected

ProductAffectedFixed inSource
n8n< 2.4.8–CNA

Scores by source

NVD9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
GitHub_M (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/n8n-io/n8n/security/advisories/GHSA-8398-gmmx-564h