Using string formatting and exception handling, an attacker may bypass n8n's python-task-executor sandbox restrictions and run arbitrary unrestricted Python cod…

CVE-2026-0863 is a critical vulnerability in n8n's python-task-executor that allows authenticated users to bypass sandbox restrictions using string formatting and exception handling techniques. The vulnerability enables arbitrary Python code execution on the underlying operating system through the Code block feature. In Internal execution mode, this leads to complete n8n instance takeover. External execution mode (like Docker) limits impact to sidecar containers. The vulnerability affects the python task execution sandbox and can be exploited by users with basic permissions.