n8n computer-use search_files Path-Confinement Bypass
First seen Jul 23, 2026 · Updated Jul 23, 2026
The @n8n/computer-use file-search tool used by AI agent workflows in n8n failed to properly confine search patterns to a designated base directory, allowing crafted inputs to escape the sandbox and read arbitrary files accessible to the daemon's OS user. This affects any deployment where an untrusted actor or agent-driven input could influence the search query, resulting in local file disclosure outside the intended scope. The issue has been patched in n8n 2.31.5 and 2.32.1.
Technical Analysis
The search_files tool implements a directory confinement check meant to restrict file search operations to a configured base path, but the validation logic could be bypassed using a specially crafted search pattern (likely via path traversal sequences or glob/regex expansion tricks not properly sanitized). Because this tool is exposed to an AI agent as a callable action, any prompt injection or malicious task input that induces the agent to pass a crafted pattern would cause the underlying tool call to read files outside the sandboxed directory, including OS-level sensitive files readable by the process user. The entry point is agent-controlled or user-controlled tool-call arguments, and the boundary crossed is the tool's declared filesystem sandbox versus the actual OS filesystem permissions of the n8n process. The attacker gains disclosure of file names and contents anywhere the daemon can read, which could include credentials, config files, or other workflow secrets, enabling further lateral movement or credential-based escalation.
Affected Systems
n8n, @n8n/computer-use
Detection Signatures
- Log entries showing search_files calls with path traversal sequences (../, absolute paths, or unexpected glob wildcards) targeting locations outside the configured base directory
- Unexpected access to files outside workflow-designated directories in n8n process file-access logs
- AI agent workflow logs showing tool arguments with anomalous path patterns or repeated probing of filesystem boundaries
- File reads by n8n process user to system paths (e.g., /etc/, ~/.ssh/, config directories) not part of normal workflow operation
Remediation Steps
- 1
Upgrade n8n
Update to n8n version 2.31.5, 2.32.1, or later where the path-confinement bypass is fixed.
- 2
Restrict instance access
Limit n8n instance access to fully trusted users until patched, especially for workflows using computer-use tools.
- 3
Disable vulnerable workflows
Temporarily disable or remove AI agent workflows that use the computer-use package until upgraded.
- 4
Run with least privilege
Ensure the n8n process runs under a dedicated low-privilege OS account to limit the blast radius of any sandbox escape.
- 5
Monitor file access
Add monitoring/alerting for file-search tool calls attempting to traverse outside configured base directories.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.