GHSA-jwm3-qcfw-c5pp

What it actually does

The n8n Python Code node relies on an AST validator to reject unsafe Python before it runs. This flaw lets crafted source skip that check, so blocked operations can execute in the Code node runtime under the n8n process identity. Impact is remote code execution in the workflow engine, not unauthenticated pre-auth RCE on the network listener.

Why it matters to the business

Anyone who can create or edit workflows with a Python Code node can run unauthorized code on the automation host, exposing credentials stored in n8n, downstream SaaS tokens, and connected systems. The issue is not listed in CISA KEV, has no reported in-the-wild exploitation or ransomware use, and is scored moderate, but it has been public for about four months—unpatched n8n instances that allow Python Code nodes remain a realistic insider and compromised-account risk.

How an attack unfolds

An attacker who already has n8n credentials (or a stolen API key) with permission to author workflows adds or edits a Python Code node. They submit Python that the AST validator incorrectly treats as safe. When the workflow runs, the Code node evaluates that source and the attacker’s code runs in the n8n execution context. From there they can read environment secrets, call internal APIs, or use connected credentials. No public exploit maturity is reported, and no named threat actors are associated with this advisory.

How to fix it

Upgrade the n8n npm package to 2.25.7 (2.25.x line) or 2.26.2 (2.26.x line) or later on every instance. If you cannot patch immediately, disable or restrict the Python Code node, limit workflow-edit rights to a small admin group, and keep Code-node execution off untrusted or multi-tenant instances. Recycle credentials stored in n8n after upgrading if untrusted users could have edited workflows.

How to confirm the fix worked

Confirm the running n8n version is 2.25.7+, 2.26.2+, or a later release (package.json, container image tag, or the in-app version string). Inventory workflows for Python Code nodes and review who can create or edit them. After upgrade, confirm a previously blocked unsafe Python pattern is rejected again and that legitimate Code-node jobs still complete.

Typical attack path

1. Obtain a valid n8n user session or API credential that can create or modify workflows
2. Open or import a workflow that includes a Python Code node
3. Place Python in the node that bypasses the AST safety validator
4. Execute the workflow (manual run, webhook, or schedule) so the Code node evaluates the source
5. Use the resulting code execution to read secrets, abuse stored credentials, or persist via additional workflows

How to detect it

There is no public exploit kit and no named actor reporting for this issue, so hunt for abuse of the Python Code node rather than a single payload. Review n8n audit and workflow-history logs for creates or updates of Code nodes using Python around and after 2026-06-16. Inspect execution logs for Code-node failures, unexpected module loads, or runs that touch files, sockets, or subprocesses. On the host, look for the n8n process spawning python/python3 or writing outside normal n8n data directories. Export and review workflow JSON for Python Code nodes that import OS, networking, or subprocess libraries. Correlate with unusual use of stored credentials or outbound connections from the n8n host at the same timestamps.

• n8n-nodes-base.code
• "language":"python"
• python3 spawned by n8n
• /usr/bin/python3 parent n8n
• Code node execution failed
• workflow updated code node python
• pyodide
• n8n task runner python

What your security team should do

• Patch all n8n (npm) deployments to 2.25.7, 2.26.2, or newer without waiting for KEV listing
• Restrict workflow authoring and Code-node use to trusted operators; disable Python Code nodes where unused
• Review workflow change history and Python Code node contents for the period before the upgrade
• Rotate n8n encryption keys, stored credentials, and integration tokens if untrusted editors had access
• Alert on new or modified Python Code nodes and on n8n spawning unexpected OS interpreters