CVE-2026-65590 affects the @n8n/computer-use package: its shell sandbox was applied only on macOS, so on Linux and Windows commands ran without filesystem or network limits. It is fixed in n8n 2.29.8 and 2.30.1. Standard n8n installs without that package are not affected, per the vendor.
What's affected
- Product: n8n, only where the @n8n/computer-use package is installed and running.
- Affected versions: before 2.29.8, and 2.30.x before 2.30.1.
- Fixed versions: 2.29.8 and 2.30.1, which add sandbox enforcement on Linux and Windows.
- Not affected: standard n8n installations that do not run @n8n/computer-use, according to the n8n advisory.
- Weakness: CWE-78 OS command injection as classified in the record.
- Scores differ by source. NVD lists CVSS 9.8. The n8n GitHub advisory rates it Moderate, and VulnCheck lists CVSS 4.0 at 5.5. Read the advisory text to judge your own exposure.
How to check if you're exposed
First find out whether the package is present at all. Most n8n installs will not have it.
npm ls -g @n8n/computer-use
npm ls @n8n/computer-use
find / -type d -path '*node_modules/@n8n/computer-use' 2>/dev/null
In a container image, run the same search inside the image, or check the lock file in the repository that builds it. If the package is there, check the n8n version:
n8n --version
Versions below 2.29.8 on that branch, or below 2.30.1 on the 2.30 branch, are in range.
What to do now
- Search hosts, images and lock files for @n8n/computer-use.
- If it is not installed, record that and stop. The advisory says standard installs are not affected.
- If it is installed, upgrade n8n to 2.29.8 or 2.30.1 or later.
- Until you can upgrade, stop the computer-use agent or run it in a container or VM with restricted filesystem and network access.
- Review which workflows can call the shell tool and who can edit them.
Why it matters
The shell tool in this package had sandbox rules, but the code that applied them ran only on macOS. On Linux and Windows the same tool ran commands with the full rights of the agent process, including the host filesystem and network.
This is a good example of a control that exists but is not uniform across platforms. Teams often test on a laptop and deploy on Linux. A sandbox that works in one place and not in the other gives a false sense of safety. The CISA KEV flag is false and the advisory does not report exploitation.
Try it yourself
A dependency check at pull request time is the cheapest place to catch an agent package like this before it reaches a server.
Click through it at your own pace, or open it full screen.
Quick check
Do I need to patch if I run plain n8n?
The advisory says standard installations are not affected. Confirm the package is absent, then upgrade on your normal schedule.
Why do the severity ratings differ so much?
The scoring sources weigh the preconditions differently. NVD shows 9.8, while the vendor and VulnCheck score it lower because the package must be installed and the tool must be run.
Sources
Last reviewed: 19 October 2026.
