NEW SANDBOX ESCAPE FLAW EXPOSES N8N INSTANCES TO RCE ATTACKS

Summary from the TLDR InfoSec newsletter

Researchers from JFrog discovered two new vulnerabilities in the n8n workflow automation platform that could allow for RCE, one of which received a CVSS score of 9.9. The two vulnerabilities are AST sandbox escapes in both Python and JavaScript sandboxes that could allow for arbitrary code execution on the underlying nodes. The vulnerability has been fixed in the n8n cloud platform, but users running self-hosted versions should update to fix it.