RCE in N8n-io N8n
CVE-2026-65590
n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the @n8n/computer-use package (sandboxing was applied only on macOS). Shell commands executed by the tool run without any filesy…
Vulnerability class: Command Injection (OS Command Injection)
Affected products
- N8n-io N8n — versions 0, 2.30.1, 2.29.8
Weakness classification (CWE)
References
- disclosure@vulncheck.com (vendor-advisory)
- disclosure@vulncheck.com (third-party-advisory)