Arbitrary Code Execution in n8n's Python Task Executor by n8n
CVE-2026-0863

8.5HIGH

Key Information:

Status
Vendor
CVE Published:
18 January 2026

What is CVE-2026-0863?

An attacker can exploit a vulnerability in n8n's Python task executor to bypass sandbox restrictions, allowing execution of arbitrary Python code on the server. This is achievable through the Code block by an authenticated user with basic permissions under 'Internal' execution mode, potentially resulting in a complete n8n instance takeover. In cases where 'External' execution mode is used (such as in the official Docker setup), arbitrary code execution is restricted to a Sidecar container, significantly mitigating impact.

References

https://research.jfrog.com/vulnerabilities/n8n-python-run...
third-party-advisory
https://github.com/n8n-io/n8n/commit/b73a4283cb14e0f27ce1...
patch

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.