Is there a patch available for CVE-2026-65590?

Yes, a patch is available for CVE-2026-65590. Update the affected software to the latest version immediately.

n8n CVE-2026-65590

Q: What is the CVSS score of CVE-2026-65590?

CVE-2026-65590 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-47634 MEDIUM

OS Command Injection (CWE-78)

2026-07-22 VulnCheck

GHSA-4v35-78jc-648r

GHSA-fpg6-x68q-5793

Microsoft Apple Command Injection N8n

5.5

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.0 HIGH

Requires non-default @n8n/computer-use on Linux/Windows (AC:H) and high-privilege n8n access (PR:H); full host OS escape drives S:C with C/I/A:H.

3.1 AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 22, 2026 - 13:02 EUVD

Analysis Generated

Jul 22, 2026 - 12:30 vuln.today

CVE Published

Jul 22, 2026 - 11:21 cve.org

MEDIUM 5.5

DescriptionCVE.org

n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the @n8n/computer-use package (sandboxing was applied only on macOS). Shell commands executed by the tool run without any filesystem or network restrictions, allowing unrestricted access to the host filesystem and network from within the computer-use agent process. This issue only affects deployments where the @n8n/computer-use package is explicitly installed and running; standard n8n installations are not affected.

AnalysisAI

Shell sandbox bypass in the optional @n8n/computer-use package for n8n exposes the full host filesystem and network to any privileged user who can invoke a computer-use workflow on Linux or Windows, because sandboxing was only implemented for macOS. Affected are n8n versions before 2.29.8 and 2.30.x before 2.30.1; standard n8n installations without the @n8n/computer-use package are entirely unaffected. No public exploit has been identified at time of analysis, but the subsequent-system impact is rated High across confidentiality, integrity, and availability in the vendor-sourced CVSS 4.0 vector.

Technical ContextAI

n8n is an open-source workflow automation platform; @n8n/computer-use is an optional add-on that enables AI agent-driven shell and desktop interaction. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command): the sandboxing logic that restricts filesystem and network access for executed shell commands was conditionally applied only on macOS, leaving the Linux and Windows code paths completely unsandboxed. When the computer-use agent executes shell commands on those platforms, it calls the host OS shell without any confinement, enabling a sandbox escape from the n8n process into the underlying host environment. CPE data identifies the affected product as cpe:2.3:a:n8n-io:n8n across all versions prior to the patched releases. Tags reference Apple (macOS, where the fix was already in place), Microsoft (Windows, newly affected), and n8n as the vendor.

RemediationAI

The primary fix is to upgrade n8n to version 2.29.8 or later on the 2.29.x branch, or to 2.30.1 or later on the 2.30.x branch, as confirmed by the vendor security advisory at https://github.com/n8n-io/n8n/security/advisories/GHSA-fpg6-x68q-5793. If immediate patching is not feasible, the most effective compensating control is to uninstall or disable the @n8n/computer-use package on Linux and Windows hosts entirely - this eliminates the attack surface completely, with the trade-off of losing all computer-use agent functionality. As an additional layer, restrict creation and execution of workflows that invoke computer-use capabilities to only the most trusted administrators, reducing the pool of principals who can trigger the vulnerable code path. Running the n8n process inside a container with minimal host filesystem bind-mounts and restrictive network egress policies (e.g., via seccomp or network namespaces) can limit the blast radius of exploitation on Linux hosts until the patch is applied, though these controls add operational overhead. Additional details are available via the VulnCheck advisory at https://www.vulncheck.com/advisories/n8n-before-shell-sandbox-bypass-on-linux-windows.