NEW N8N VULNERABILITY (9.9 CVSS) LETS AUTHENTICATED USERS EXECUTE SYSTEM COMMANDS

Summary from the TLDR InfoSec newsletter

A critical flaw in n8n (CVE-2025-68668) allows authenticated users with workflow permissions to bypass the Python sandbox and run arbitrary OS commands on the host, scoring 9.9 on CVSS. The issue affects versions 1.0.0 through 2.0.0 and is fixed in 2.0.0. Mitigations include disabling the Code Node, turning off Python support, or using task runner-based isolation.