Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-tfcu-w2ek-wkf9

Summary

n8n has a Sandbox Escape in its JavaScript Task Runner
An authenticated user with permission to create or modify workflows could exploit a vulnerability in the JavaScript Task Runner sandbox to execute arbitrary code outside the sandbox boundary.

On instances using internal Task Runners (default runner mode), this could result in full compromise of the n8n host. On instances using external Task Runners, the attacker might gain access to or impact other task executed on the Task Runner.
- Task Runners must be enabled using `N8N_RUNNERS_ENABLED=true`.

Aliases

alias	CVE-2026-27495

alias	GHSA-jjpj-p2wh-qf23

Fixed_packages

url	pkg:npm/n8n@1.123.22
purl	pkg:npm/n8n@1.123.22
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:npm/n8n@1.123.22

url	pkg:npm/n8n@2.9.3
purl	pkg:npm/n8n@2.9.3
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:npm/n8n@2.9.3

url	pkg:npm/n8n@2.10.1
purl	pkg:npm/n8n@2.10.1
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:npm/n8n@2.10.1

Affected_packages

url pkg:npm/n8n@2.0.0

purl pkg:npm/n8n@2.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-2srm-ktga-w7hb

vulnerability	VCID-3bk2-zvud-c7et

vulnerability	VCID-3qs7-8ewt-j3aa

vulnerability	VCID-4w75-581c-3ycz

vulnerability	VCID-6f6h-nx37-fqbx

vulnerability	VCID-akxw-urjb-qff8

vulnerability	VCID-axyq-35hd-skhq

vulnerability	VCID-dd53-wba6-f3c6

vulnerability	VCID-h82c-378t-aqb3

vulnerability	VCID-j3t9-jkr4-7fbc

vulnerability	VCID-ka79-3enj-fkew

vulnerability	VCID-nafx-g818-nbb6

vulnerability	VCID-srsg-ge6y-2ybu

vulnerability	VCID-tfcu-w2ek-wkf9

vulnerability	VCID-txf4-9gr1-ekcj

vulnerability	VCID-upx4-rmwg-yqfz

vulnerability	VCID-wz7x-wqw3-wbg5

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/n8n@2.0.0

url pkg:npm/n8n@2.10.0

purl pkg:npm/n8n@2.10.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-3bk2-zvud-c7et

vulnerability	VCID-axyq-35hd-skhq

vulnerability	VCID-dd53-wba6-f3c6

vulnerability	VCID-j3t9-jkr4-7fbc

vulnerability	VCID-ka79-3enj-fkew

vulnerability	VCID-srsg-ge6y-2ybu

vulnerability	VCID-tfcu-w2ek-wkf9

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/n8n@2.10.0

References

reference_url	https://docs.n8n.io/hosting/configuration/task-runners
reference_id
reference_type
scores
url	https://docs.n8n.io/hosting/configuration/task-runners

reference_url	https://github.com/n8n-io/n8n
reference_id
reference_type
scores
url	https://github.com/n8n-io/n8n

reference_url	https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.22
reference_id
reference_type
scores
url	https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.22

reference_url	https://github.com/n8n-io/n8n/releases/tag/n8n@2.10.1
reference_id
reference_type
scores
url	https://github.com/n8n-io/n8n/releases/tag/n8n@2.10.1

reference_url	https://github.com/n8n-io/n8n/releases/tag/n8n@2.9.3
reference_id
reference_type
scores
url	https://github.com/n8n-io/n8n/releases/tag/n8n@2.9.3

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2026-27495
reference_id	CVE-2026-27495
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2026-27495

reference_url	https://github.com/advisories/GHSA-jjpj-p2wh-qf23
reference_id	GHSA-jjpj-p2wh-qf23
reference_type
scores
url	https://github.com/advisories/GHSA-jjpj-p2wh-qf23

reference_url	https://github.com/n8n-io/n8n/security/advisories/GHSA-jjpj-p2wh-qf23
reference_id	GHSA-jjpj-p2wh-qf23
reference_type
scores
url	https://github.com/n8n-io/n8n/security/advisories/GHSA-jjpj-p2wh-qf23

Weaknesses

cwe_id	94
name	Improper Control of Generation of Code ('Code Injection')
description	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

Exploits

Severity_range_score null

Exploitability null

Weighted_severity null

Risk_score null

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-tfcu-w2ek-wkf9

Vulnerability Instance