GHSA-4v35-78jc-648rMedium▾ SunlitDuplicate Advisory: computer-use Shell Sandbox Not Enforced on Linux and Windows
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
This advisory has been withdrawn because it is a duplicate of GHSA-fpg6-x68q-5793. This link is maintained to preserve external references.
n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the @n8n/computer-use package (sandboxing was applied only on macOS). Shell commands executed by the tool run without any filesystem or network restrictions, allowing unrestricted access to the host filesystem and network from within the computer-use agent process. This issue only affects deployments where the @n8n/computer-use package is explicitly installed and running; standard n8n installations are not affected.
@n8n/computer-use < 2.29.8Refer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-65590Mediumn8n: computer-use Shell Sandbox Not Enforced on Linux and Windows
GHSA-rcv6-pvrj-4xcgHighn8n: Authenticated code execution in the n8n Git node
CVE-2026-72767High· 8.8n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a remote code execution vulnerability in the Git node
CVE-2026-85168High· 8.8n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in the Git node
CVE-2025-9580Medium· 6.3A security vulnerability has been detected in LB-LINK BL-X26 1.2.8
CVE-2025-9579Medium· 6.3A weakness has been identified in LB-LINK BL-X26 1.2.8