The code node wasn't sandboxed. The file upload wasn't checked either.
n8n is a widely deployed, self-hostable workflow-automation platform — the kind of tool that wires webhooks, APIs, file storage, and increasingly AI/LLM nodes together into a pipeline that runs unattended. Over a roughly five-week window this past winter, security researchers disclosed two separate CVSS-10-class bugs in it. Neither is exotic. Both are the same underlying failure wearing a different costume: a boundary the platform's design assumed would hold, that turned out not to be enforced anywhere in the actual code path.
bug one: a header the server believed instead of checked
CVE-2026-21858, nicknamed Ni8mare, is content-type confusion in how n8n's public-facing form/webhook nodes handle file uploads. A form workflow that accepts uploads without its own content-type validation lets an attacker overwrite an internal JSON object, which opens a path to reading arbitrary local files on the server — unauthenticated, no account needed. From there, researchers documented a path to forging administrator-level sessions and ultimately remote code execution. It affected n8n 1.65.0 through 1.120.x, was quietly patched in 1.121.0 in November 2025, and got a public advisory in January 2026. CVSS 10.0 — the maximum score the scale allows. Rapid7 estimated roughly 100,000 self-hosted instances were exposed to some version of the exploit surface.
The detail worth sitting with: exploiting the file-read primitive into something useful still requires a way to actually see the file contents you just tricked the server into reading. One documented path researchers pointed to was using an AI chatbot node already wired into the same workflow — one with file-read access — as the exfiltration channel. The vulnerability is in the upload handler. The thing that turns "we can make the server touch an arbitrary file" into "we can read that file back" was an AI node that had more reach than the person who wired it in probably budgeted for.
bug two: a sandbox that only sandboxed the easy part
CVE-2025-68668, nicknamed N8scape, hit n8n's Python "Code" node — the one that lets a workflow author drop arbitrary Python into a pipeline step, executed inside a Pyodide (WASM-compiled Python) sandbox specifically so that arbitrary Python doesn't mean arbitrary host access. Researchers found a way out of that sandbox: an authenticated user with permission to create or edit a workflow could escape it and run commands directly on the host machine running n8n. CVSS 9.9, disclosed in late December 2025, affecting a wide version range (1.0.0 through 2.0.0).
"Authenticated" sounds like a meaningfully higher bar than Ni8mare's zero-auth path — and in a narrow sense it is. But "authenticated" in an automation platform doesn't only mean "a human with a password." It also describes exactly the access level an AI agent node typically operates at once it's been given credentials to build or modify workflows on your behalf, which is an increasingly normal thing to hand one. A sandbox whose walls only hold against a well-behaved caller isn't protecting you from the caller you're actually worried about.
the pattern, not the platform
Neither of these is a knock on n8n specifically — they're the kind of bug that gets found in any sufficiently popular platform that accepts untrusted input and runs untrusted code, because someone eventually looks hard enough to find where the stated boundary and the actual enforced boundary diverge. What's worth noticing is the timing, not the target: both bugs landed in a tool whose entire value proposition is running unattended, and both were found within a season of each other, in different parts of the same platform's trust model (input validation on one side, execution isolation on the other).
Automation platforms have spent the last two years adding AI/LLM nodes as a headline feature — an agent step that can read files, call APIs, write outputs, chain into the next node. That's a genuinely useful capability. It also means a bug that used to be "someone could read a config file off a webapp" now sits one hop away from a component explicitly designed to read files and act on what it finds, on your behalf, without asking each time. The file-read primitive in Ni8mare didn't become critical because of the file read. It became critical because something downstream was already built to make use of whatever it found.
If you're running a workflow-automation platform with any AI/agent nodes wired in, the question worth asking isn't just "is our version patched" (check that too). It's "what, specifically, enforces the boundary around our code-execution and file-access nodes, and have we ever actually tested that it holds — not read the docs that say it should." For both of these bugs, the gap between "we assumed this was sandboxed" and "this was sandboxed" is where the CVSS 10.0 came from.
Sources: Rapid7's technical writeup on both vulnerabilities, the NVD entries for CVE-2026-21858 and CVE-2025-68668. No exploitation in the wild has been confirmed for either as of publication — both are proof-of-concept research disclosures. If you run n8n, the versions above are the ones to check.