Nixpkgs security tracker

Login with GitHub

Details of issue NIXPKGS-2026-1391

NIXPKGS-2026-1391
published on
updated an hour ago by @LeSuisse Activity log
  • Created suggestion
  • @LeSuisse ignored
    3 packages
    • n8n-nodes-carbonejs
    • n8n-nodes-evolution-api
    • n8n-task-runner-launcher
  • @LeSuisse accepted
  • @LeSuisse published on GitHub
n8n: Python Task Runner Sandbox Escape

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an authenticated user with permission to create or modify workflows containing a Python Code Node could escape the sandbox and achieve arbitrary code execution on the task runner container. This issue only affects instances where the Python Task Runner is enabled. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.

Affected products

n8n
  • ==>= 2.18.0, < 2.18.1
  • ==< 1.123.32
  • ==>= 2.17.0, < 2.17.4

Matching in nixpkgs

pkgs.n8n

Free and source-available fair-code licensed workflow automation tool

Ignored packages (3)

Package maintainers