GHSA-jwm3-qcfw-c5pp: n8n: Python Code Node AST Validator Bypass
An authenticated user with permission to create or modify workflows containing a Python Code node could bypass the AST security validator and access the task executor module namespace. On self-hosted instances where N8N_BLOCK_RUNNER_ENV_ACCESS=false is set, this extended to disclosure of environment variables accessible to the task runner process.
This issue only affects instances where the Python Task Runner is enabled and N8N_BLOCK_RUNNER_ENV_ACCESS=true.
References
Code Behaviors & Features
Detect and mitigate GHSA-jwm3-qcfw-c5pp with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →