NIXPKGS-2026-1391
GitHub issue
published on
by @LeSuisse Activity log
- Created suggestion
-
@LeSuisse
ignored
3 packages
- n8n-nodes-carbonejs
- n8n-nodes-evolution-api
- n8n-task-runner-launcher
- @LeSuisse accepted
- @LeSuisse published on GitHub
n8n: Python Task Runner Sandbox Escape
n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an authenticated user with permission to create or modify workflows containing a Python Code Node could escape the sandbox and achieve arbitrary code execution on the task runner container. This issue only affects instances where the Python Task Runner is enabled. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.
References
-
https://github.com/n8n-io/n8n/security/advisories/GHSA-44v6-jhgm-p3m4 x_refsource_CONFIRM
Affected products
n8n
- ==>= 2.18.0, < 2.18.1
- ==< 1.123.32
- ==>= 2.17.0, < 2.17.4
Matching in nixpkgs
Ignored packages (3)
pkgs.n8n-nodes-carbonejs
n8n community node for rendering Word templates using Carbone.js
pkgs.n8n-nodes-evolution-api
Evolution API hub for WhatsApp integration with n8n
pkgs.n8n-task-runner-launcher
Launcher for n8n task runners
Package maintainers
-
@sweenu sweenu <contact@sweenu.xyz>
-
@AdrienLemaire Adrien Lemaire <lemaire.adrien@gmail.com>
-
@gepbird Gutyina Gergő <gutyina.gergo.2@gmail.com>