n8n EUVD-2026-47634

Exploitation requires three concurrent conditions: (1) the @n8n/computer-use package must be explicitly installed and actively running - it is not part of a standard n8n installation and must be deliberately added by the operator; (2) the host operating system must be Linux or Windows, as macOS correctly enforces sandbox restrictions and is not affected; (3) the attacker must hold high-privilege access (PR:H per the CVSS 4.0 vector) within the n8n instance, sufficient to create or execute workflows invoking the computer-use agent. No special conditions limit exploitation once these prerequisites are met - an authenticated high-privilege user can execute arbitrary shell commands against the host. The primary limiting factors for defenders are the non-default package requirement and the PR:H authentication threshold, which together mean the vast majority of n8n deployments are not exposed.

The CVSS 4.0 score of 5.5 is moderate overall, but the metric breakdown reveals a more nuanced picture: PR:H and AT:P together reflect that exploitation requires both high-privilege authenticated access to n8n and the deliberate, non-default installation of the @n8n/computer-use package on Linux or Windows - a small subset of all n8n deployments. However, within that subset, the subsequent-system impact metrics SC:H/SI:H/SA:H indicate a full host OS compromise is achievable, meaning the actual blast radius for affected deployments is severe. No EPSS score was provided in the input data. The absence from CISA KEV and the lack of any identified public exploit further reduce immediate urgency for most operators. Multi-tenant or shared n8n deployments where semi-trusted users have workflow execution rights represent the highest-risk configurations, as the PR:H threshold can be met by legitimate platform users - not just external attackers. The discrepancy between the moderate overall score and the high subsequent-system impact is an expected artifact of CVSS 4.0's scoring model for scope-changing, privilege-conditional vulnerabilities and should not be misread as low severity for qualifying environments.

A privileged n8n user on a Linux or Windows deployment with @n8n/computer-use installed constructs a workflow that invokes the computer-use agent with a shell command designed to exfiltrate sensitive files - for example, reading SSH private keys or cloud credential files from the host filesystem and transmitting them to an attacker-controlled server. Because no sandbox restrictions are enforced on Linux and Windows, the shell command executes with the full permissions of the n8n process, granting read/write access to the entire host filesystem and unrestricted outbound network access. No public proof-of-concept exploit has been identified at time of analysis.