n8n computer-use Shell Sandbox Bypass on Linux/Windows
First seen Jul 23, 2026 · Updated Jul 23, 2026
The n8n computer-use package's shell tool was supposed to restrict filesystem and network access via a sandbox, but this enforcement only worked on macOS. On Linux and Windows, any command executed by the agent's shell tool ran with full, unrestricted access to the host filesystem and network, defeating the intended containment. This is only relevant to deployments that explicitly enable the computer-use package.
Technical Analysis
The computer-use agent exposes a shell execution tool intended to run inside a sandbox that limits filesystem and network reach, presumably to contain the blast radius of untrusted or LLM-generated commands. The sandbox enforcement logic was implemented only for macOS, so on Linux and Windows the shell tool executed commands directly on the host with no restrictions. An attacker who can influence the agent's tool inputs (via prompt injection, malicious workflow content, or a compromised upstream data source) could therefore issue arbitrary shell commands with the full privileges of the n8n process, achieving host-level code execution, data exfiltration, or lateral network access. The vulnerability crosses the boundary between 'trusted agent orchestration' and 'untrusted execution environment' by silently failing open instead of failing closed when a sandbox could not be established.
Affected Systems
n8n, @n8n/computer-use
Detection Signatures
- Presence of @n8n/computer-use package in deployment on Linux or Windows hosts
- Absence of bubblewrap (bwrap) invocation in shell tool process tree on Linux
- Shell tool executing commands with unrestricted filesystem paths (e.g., access to /etc, /root, C:\Windows) from computer-use agent process
- Outbound network connections originating from computer-use shell tool process to unexpected hosts
- n8n version < 2.29.8 or between 2.30.0 and 2.30.1 running computer-use package
Remediation Steps
- 1
Upgrade n8n
Update to n8n 2.29.8, 2.30.1, or later, which enforce sandboxing via bubblewrap on Linux and disable the shell tool when no working sandbox can be established.
- 2
Audit computer-use deployments
Identify all instances where @n8n/computer-use is explicitly installed on Linux or Windows hosts and confirm they are patched or disabled until patched.
- 3
Restrict access
Limit access to n8n instances running the computer-use agent to fully trusted users only as an interim mitigation.
- 4
Avoid unsafe opt-out
Do not use the --dangerously-disable-shell-sandbox flag unless the risk is fully understood and accepted, and only in isolated, non-sensitive environments.
- 5
Monitor shell tool activity
Add logging/monitoring around the computer-use shell tool to detect unexpected filesystem or network access patterns indicative of sandbox bypass exploitation.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.