CVE-2026-25115: 
NixOS vulnerability analysis and mitigation

CVE-2026-25115 is a Python sandbox escape vulnerability in n8n, an open-source workflow automation platform, that allows authenticated users to break out of the Python sandbox environment and execute arbitrary code outside the intended security boundary. It affects all n8n versions prior to 2.4.8 and was published on February 4, 2026. The vulnerability has a CVSS v4.0 base score of 9.4 (Critical) and a CVSS v3.1 base score of 9.9 (Critical) (GitHub Advisory, n8n Advisory).

The vulnerability is classified as CWE-693 (Protection Mechanism Failure), meaning the Python sandbox implemented in n8n's Code node does not adequately prevent escape to the broader execution environment. Exploitation requires three specific conditions to be met simultaneously: Task Runners must be enabled (N8N_RUNNERS_ENABLED=true, default: false), Python must be enabled (N8N_PYTHON_ENABLED=true), and the Code Node must be enabled (default: true). When Task Runners operate in the default internal mode, a successful sandbox escape grants code execution within the main n8n process; when configured in external mode (N8N_RUNNERS_MODE=external), the escape is limited to the sidecar container, significantly reducing lateral movement risk. The vulnerability was reported by researchers MarcoPoloPie and c0rydoras (n8n Advisory).

Successful exploitation allows an authenticated attacker to execute arbitrary code outside the Python sandbox, resulting in high confidentiality, integrity, and availability impact on both the vulnerable n8n system and subsequent systems it can reach. In internal Task Runner mode, the attacker gains code execution within the main n8n process, enabling access to sensitive workflow data, credentials stored in n8n, and potential lateral movement to connected systems and services. In external mode, the blast radius is limited to the sidecar container, reducing but not eliminating risk (GitHub Advisory, n8n Advisory).

As of the time of publication, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.075% (23rd percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access with low privileges, and the vulnerable configuration (Task Runners + Python enabled) is not the default, which further limits the exposed attack surface.

1. Reconnaissance: Identify n8n instances (version < 2.4.8) exposed over the network, particularly those with Task Runners enabled (N8N_RUNNERS_ENABLED=true) and Python support active (N8N_PYTHON_ENABLED=true).
2. Obtain authenticated access: Acquire valid n8n user credentials — this could be through phishing, credential stuffing, or use of a low-privilege account (e.g., a free trial or shared account).
3. Create or access a workflow with a Python Code node: Log in to the n8n instance and create a new workflow containing a Python Code node, or access an existing one.
4. Craft sandbox escape payload: Insert a Python payload designed to break out of the sandbox environment — typical techniques include abusing Python's introspection capabilities (e.g., __class__.__mro__, __subclasses__()) to access restricted built-ins or OS-level functions.
5. Execute arbitrary code: Trigger the workflow to execute the malicious Python code, achieving code execution outside the sandbox — within the main n8n process (internal mode) or the sidecar container (external mode).
6. Post-exploitation: Use the gained execution context to exfiltrate sensitive data (credentials, workflow secrets), establish persistence, or pivot to connected systems and services integrated with n8n (n8n Advisory).

• Logs: Unexpected or anomalous Python code execution events in n8n task runner logs; errors or stack traces related to sandbox boundary violations in n8n application logs; unusual workflow execution patterns from low-privilege accounts.
• Process: Unexpected child processes spawned by the n8n Node.js process or task runner (e.g., sh, bash, python3, curl, wget); unusual network connections initiated from the n8n process or sidecar container.
• Network: Outbound connections from the n8n server or sidecar container to unknown external IPs or domains, particularly on non-standard ports; DNS queries for unexpected external hosts originating from the n8n host.
• File System: New or modified files in the n8n working directory or sidecar container filesystem; unexpected scripts, cron jobs, or SSH keys created by the n8n service account.

Upgrade n8n to version 2.4.8 or later, which contains the official patch for this vulnerability (n8n Advisory). If an immediate upgrade is not possible, apply the following workarounds in order of priority:

• Disable the Code Node by adding n8n-nodes-base.code to the NODES_EXCLUDE environment variable.
• Switch to external Task Runner mode (N8N_RUNNERS_MODE=external) to isolate untrusted code execution in a separate sidecar container, limiting the impact of any sandbox escape.
• Restrict access to the Python Code node to only trusted, vetted users and monitor for suspicious workflow execution activity.

The vulnerability received coverage from The Hacker News in the context of multiple critical n8n flaws (The Hacker News). Belgium's Centre for Cybersecurity (CCB) issued an advisory warning about multiple critical vulnerabilities in n8n, including this sandbox escape (CCB Advisory). Security researchers and community accounts on Mastodon and Bluesky shared alerts about the flaw shortly after disclosure. Endor Labs published a technical analysis covering related n8n RCE vulnerabilities (Endor Labs).