CVE-2026-25115 CRITICAL

CVE-2026-25115: n8n is vulnerable to Python sandbox escape

Vendor N8N-Io

Product n8n

Weakness CWE-693

Published February 4, 2026

Last update February 5, 2026

View on NVD All CVEs

CVSS base score

9.4/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

What the vulnerability does

Description

n8n is an open source workflow automation platform. Prior to version 2.4.8, a vulnerability in the Python Code node allows authenticated users to break out of the Python sandbox environment and execute code outside the intended security boundary. This issue has been patched in version 2.4.8.

Key dates

Disclosure timeline

February 4, 2026 CVE published

February 5, 2026 Record updated