sandbox escape Articles

New n8n Vulnerability CVE-2026-25049 Bypasses Previous Patch to Enable Remote Code Execution

A critical flaw in n8n (CVSS 9.4) exploits TypeScript/JavaScript type mismatch to bypass sanitization from a December 2025 patch, enabling authenticated remote command execution via webhook workflows.

February 4, 2026 n8n vulnerability RCE

New n8n Sandbox Escape Vulnerabilities Allow Remote Code Execution

JFrog discovered two sandbox escape flaws in n8n: CVE-2026-1470 (CVSS 9.9) bypasses JavaScript sandboxing via deprecated 'with' statement, and CVE-2026-0863 (CVSS 8.5) escapes Python restrictions via AttributeError.obj.

February 2, 2026 n8n vulnerability RCE

Critical 'Cellbreak' Vulnerability in Grist Spreadsheet Platform Enables RCE

CVE-2026-24002 allows remote code execution through malicious spreadsheet formulas via Pyodide sandbox escape. Affects government, education, and enterprise deployments.

January 27, 2026 vulnerability RCE Grist