n8n before 2.29.8 and 2.30.x before 2.30.1 fails to enforce shell sandbox restrictions on Linux and Windows for the @n8n/computer-use package. Commands executed by this package run with full system access, allowing an attacker who can influence the command payload to read, modify, or delete any file on the host, install additional software, or access network resources. The underlying weakness is a CWE-78 type of input validation flaw requiring shell command execution. This can lead to full system compromise if the attacker gains the ability to dictate commands.

The vulnerability affects n8n releases prior to 2.29.8 and before 2.30.1, but only when the @n8n/computer-use package is explicitly installed and active. Deployments on Linux and Windows are susceptible; macOS implementations are not impacted because sandboxing was only applied on macOS. The issue does not affect default installations of n8n that omit the computer-use package.

The CVSS score of 5.5 indicates a medium severity; the EPSS score of <1% suggests a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The lack of sandboxing means the attack can only be carried out if an attacker can supply or influence shell commands to the computer‑use process, based on the description it is inferred that this requires local or privileged access. Consequently, the risk is moderate for deployments that use the package and expose command input without additional controls.