# sounds about right. Source: https://www.youtube.com/watch?v=UlZjPsTWg-U Recap page: https://rapidrecap.app/video/UlZjPsTWg-U Generated: 2026-01-19T16:35:14.88+00:00 --- ## Quick Overview The video analyzes four critical vulnerabilities discovered in the n8n workflow automation platform, highlighting CVE-2026-21877 (Arbitrary File Write allowing RCE) and CVE-2025-68668 (a sandbox bypass in the Python Code Node using Pyodide) as particularly severe examples of flaws that grant unauthorized code execution or file system access. **Key Points:** - Four critical n8n vulnerabilities were disclosed, including CVE-2026-21877 (CVSS 10.0) involving unrestricted file upload leading to full instance compromise. - CVE-2025-68668, dubbed N8scape, is a sandbox bypass vulnerability in the Python Code Node using Pyodide, allowing authenticated users to execute arbitrary commands on the host system with n8n process privileges. - The underlying issue in the sandbox bypass stemmed from a blocklist-based sandbox that failed to remove underlying capabilities, allowing attackers to enumerate dangerous capabilities. - The first vulnerability discussed (CVE-2025-68613, CVSS 9.9) involved improper control of dynamically-managed code resources, allowing authenticated attackers to achieve Remote Code Execution (RCE). - The speaker notes that n8n has since introduced a task-runner-based native Python implementation (version 1.111.0) and made it default in 2.0.0 to improve security isolation. - The presenter demonstrated an exploit targeting the Git Node (CVE-2026-21877) that allows arbitrary file write, potentially leading to RCE by overwriting files or executing malicious code via commit hooks. - The speaker also advertised Material Security, a cloud office security platform protecting companies using Microsoft 365 and Google Workspace, as a solution for better security visibility. ![Screenshot at 00:10: The speaker displays a Hacker News article headline detailing a 'Critical n8n Vulnerability \(CVSS 10.0\) Allows Unauthenticated Attackers to Take Full Control,' setting the stage for a discussion on severe security flaws in the platform.](https://ss.rapidrecap.app/screens/UlZjPsTWg-U/00-00-10.jpg) **Context:** The video details several critical security vulnerabilities found in n8n, an open-source workflow automation platform. The speaker reviews findings from articles detailing these flaws, specifically focusing on RCE and sandbox escape mechanisms. The context is a deep dive into how these vulnerabilities work, particularly those affecting the Python Code Node (using Pyodide) and the Git Node, and what the recommended fixes entail. ## Detailed Analysis The video analyzes four critical vulnerabilities in the n8n workflow automation platform. The first, CVE-2025-68613 (CVSS 9.9), involves improper control of dynamically-managed code resources, enabling authenticated RCE. The second, CVE-2025-68668 (N8scape, CVSS 9.9), is a sandbox bypass in the Python Code Node utilizing Pyodide's 'pyodide_base.eval_code()' function, which allows authenticated users to execute arbitrary commands on the host system with n8n process privileges because the blocklist-based sandbox failed to remove underlying capabilities. The third, CVE-2026-21877 (CVSS 10.0), is an unrestricted file upload vulnerability in the Git Node, allowing an authenticated attacker to write malicious files and chain this to achieve RCE. The speaker shows a Proof of Concept code demonstrating how to create a malicious workflow injecting JavaScript expressions. Finally, the speaker notes that n8n introduced a task-runner-based native Python implementation in version 1.111.0 (default in 2.0.0) to improve security isolation, but this mitigation relies on proper configuration, contrasting with the unpatched risks. The speaker concludes by promoting Material Security, a cloud office security platform. ### Vulnerability Overview - CVE-2025-68613 (CVSS 9.9) - Improper control of dynamically-managed code resources leading to RCE - CVE-2025-68668 (CVSS 9.9) - Sandbox bypass in Python Code Node using Pyodide - CVE-2026-21877 (CVSS 10.0) - Unrestricted file upload via Git Node leading to RCE ### N8scape (CVE-2025-68668) Details - Exists in Python Code Node using Pyodide; allows authenticated users to execute arbitrary commands on the host system with n8n process privileges - Structural problem stems from a blocklist-based sandbox that implicitly assumes the defender can enumerate every dangerous capability ### CVE-2026-21877 Exploit Chain - Authenticated attacker exploits arbitrary file write in Git Node to write malicious files, chaining this to execute arbitrary code with n8n process privileges - Exploitation involves automating a Git operation (like a commit hook) to run code ### Mitigation and Context - n8n patched vulnerabilities in specific versions (e.g., Git Node fixed in 1.121.3) - n8n introduced task-runner-based native Python implementation (version 1.111.0, default in 2.0.0) for better isolation, but configuration is key ### Sponsor Promotion - Material Security protects Microsoft 365 and Google Workspace by providing visibility across email, accounts, and files to detect phishing and misconfigurations ![Screenshot at 00:00: The speaker begins the video wearing a grey hoodie and glasses, addressing the audience directly in a home office setting.](https://ss.rapidrecap.app/screens/UlZjPsTWg-U/00-00-00.jpg) ![Screenshot at 00:10: A screenshot of a Hacker News article titled 'Critical n8n Vulnerability \(CVSS 10.0\) Allows Unauthenticated Attackers to Take Full Control' is displayed prominently.](https://ss.rapidrecap.app/screens/UlZjPsTWg-U/00-00-10.jpg) ![Screenshot at 00:21: A graphic illustrating an n8n workflow automation diagram is shown, highlighting IT Ops use cases like onboarding new employees.](https://ss.rapidrecap.app/screens/UlZjPsTWg-U/00-00-21.jpg) ![Screenshot at 02:14: A view of a GitHub repository showing Python code, specifically a function named 'create\_malicious\_workflow' which injects a payload expression.](https://ss.rapidrecap.app/screens/UlZjPsTWg-U/00-02-14.jpg) ![Screenshot at 04:12: The screen switches to a Material Security dashboard showing email threat issues, including specific phishing lures like 'Request for Financial Info'.](https://ss.rapidrecap.app/screens/UlZjPsTWg-U/00-04-12.jpg)