Dorjoos

**Name of the Vulnerable Software and Affected Versions** n8n versions prior to 1.123.69 n8n versions prior to 2.33.4 n8n versions prior to 2.34.1 **Description** A JavaScript task runner VM sandbox escape exists where the prototype-freezing routine fails to cover internal module constructors, such as `EventEmitter`. This allows an authenticated user with access to the Code node to use prototype pollution—a technique of modifying the base prototype of an object to affect all instances—to execute arbitrary commands within the runner container. Since the polluted prototype is a process-wide object, the corruption persists across other tenants' Code node executions on the same shared runner. In v1.x instances where task runners are disabled, the JavaScript in the Code node runs directly in the main n8n process, potentially increasing the impact. **Recommendations** Update n8n to version 1.123.69 or later. Update n8n to version 2.33.4 or later. Update n8n to version 2.34.1 or later.

**Name of the Vulnerable Software and Affected Versions** n8n versions prior to 1.123.32 n8n versions prior to 2.17.4 n8n versions prior to 2.18.1 **Description** An authenticated user with permissions to create or modify workflows containing a Python Code Node can escape the sandbox to achieve arbitrary code execution on the task runner container. This issue specifically affects instances where the Python Task Runner is enabled. **Recommendations** Update to version 1.123.32. Update to version 2.17.4. Update to version 2.18.1. As a temporary mitigation, disable the Python Task Runner.