CVE-2026-56777

Katalog CVE

CVSS 5.0 · Medium EPSS 0,33%

Kerentanan Incomplete List of Disallowed Inputs pada n8n. Skor CVSS 3.1 5.0 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

n8n before 2.25.7 and 2.26.x before 2.26.2 contains an abstract syntax tree (AST) security validator bypass in the Python Code node. An authenticated user with permission to create or modify workflows containing a Python Code node can bypass the validator and access the task executor module namespace. The issue only affects self-hosted instances where the Python Task Runner is enabled; where N8N_BLOCK_RUNNER_ENV_ACCESS is configured to allow it, this can disclose environment variables accessible to the task runner process.

Rincian

Terbit di NVD

30 Juni 2026

Terakhir diubah

2 Juli 2026

Status NVD

Analyzed

CVSS 3.1

5.0 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-184: Incomplete List of Disallowed Inputs

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 23,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/n8n-io/n8n/security/advisories/GHSA-jwm3-qcfw-c5pp mitigasi · advisory vendor
• https://www.vulncheck.com/advisories/n8n-ast-validator-bypass-in-python-code-node advisory pihak ketiga