Two vulnerabilities in n8n’s sandbox mechanism could be exploited for remote code execution (RCE) on the host system.
The JavaScript sandbox vm2 for Node.js was actually discontinued. Now an update closes a critical security vulnerability.