An authentication‑required user with permission to create or modify a workflow can execute code within the Python Code node that bypasses the sandbox restriction. The vulnerability permits reading arbitrary files on the host or, in the worst case, executing arbitrary code. The flaw is tied to CWE‑497 and is able to exfiltrate sensitive data or compromise the entire system when the internal Task Runner is in use.

The affected product is n8n‑io’s n8n workflow platform. Versions prior to 2.10.1, 2.9.3, and 1.123.22 are vulnerable. The fix is available in those three release versions and later.

The vulnerability carries a CVSS score of 7.1 and an EPSS score of less than 1 %, indicating a low but non‑zero likelihood of exploitation. It is not listed in the CISA KEV catalog. The attack vector is authenticated workflow creation/editing; the attacker can read sensitive files or achieve full host compromise when internal Task Runners are enabled. With external task runners, the adversary may affect other tasks on the runner. The risk is moderate with potential high impact if the sandbox escape leads to RCE.