{
 "public_id": "AIR-2026-0004",
 "incident_id": "2026-01-n8n-ni8mare-n8scape-cluster",
 "date_disclosed": "2026-01-07",
 "date_occurred": null,
 "title": "Ni8mare and N8scape: Rapid7 discloses a CVSS 10.0 arbitrary file read and a Pyodide sandbox bypass in n8n",
 "class": "responsible_disclosure",
 "attack_surface": "agent_framework",
 "initial_vector": "crafted_form_upload_and_python_code_node",
 "agent_capability_abused": [
  "form_trigger_file_upload",
  "python_code_node_execution"
 ],
 "target_product": "n8n",
 "target_vendor": "n8n GmbH",
 "autonomy_level": "semi_autonomous",
 "impact_realized": false,
 "impact_type": [
  "arbitrary_file_read",
  "privilege_escalation",
  "remote_code_execution",
  "sandbox_escape"
 ],
 "blast_radius": "n8n 1.65.0 to < 1.121.0 (Ni8mare); the platform had 100,000+ internet-exposed instances counted by Censys in the same window",
 "cve": [
  "CVE-2026-21858",
  "CVE-2026-21877",
  "CVE-2025-68668",
  "CVE-2025-68697"
 ],
 "taxonomy": {
  "owasp_asi": [
   "ASI05",
   "ASI03"
  ],
  "mitre_atlas": [],
  "labels": [
   "arbitrary_file_read",
   "prototype_pollution_style_object_overwrite",
   "sandbox_escape",
   "pyodide",
   "admin_takeover"
  ]
 },
 "defense_present": "Pyodide-based Python code node sandbox; content-type validation on form uploads",
 "defense_bypassed": true,
 "fix_shipped": "n8n 1.121.0 (CVE-2026-21858), 1.121.3 (CVE-2026-21877), 2.0.0 (CVE-2025-68668, CVE-2025-68697)",
 "primary_sources": [
  "https://www.rapid7.com/blog/post/etr-ni8mare-n8scape-flaws-multiple-critical-vulnerabilities-affecting-n8n/"
 ],
 "verified_quote": "Certain form-based workflows are vulnerable to improper file handling that can result in arbitrary file read.",
 "confidence": "high",
 "notes": "Rapid7 disclosure. CVE-2026-21858 'Ni8mare' CVSS 10.0 (arbitrary file read escalating to n8n administrator access), CVE-2026-21877 CVSS 9.9 (authenticated untrusted code execution), CVE-2025-68668 'N8scape' CVSS 9.9 (sandbox bypass in the Pyodide Python Code node), CVE-2025-68697 CVSS 5.4 (internal helper functions reachable from the Code node). Grouped as one Rapid7 disclosure cluster. Separate from CVE-2025-68613, which is its own record because it was independently exploited and reached CISA KEV. Rapid7's table lists CVE-2025-68613 fixed in 1.20.4 where n8n's own advisory says 1.120.4 - the n8n advisory is authoritative.",
 "risk_category": "security_fraud",
 "risk_secondary": [],
 "risk_subcategory": "Remote Code Execution & Sandbox Escape",
 "risk_sub_secondary": [
  "Unauthorized Access & Account Takeover"
 ],
 "ai_entity": "generative",
 "agency": "ai_as_target",
 "agency_debatable": false,
 "agency_reason": "CVSS 10.0 arbitrary file read and Pyodide sandbox bypass in n8n",
 "vector_family": "other",
 "vector_detail": "crafted_form_upload_and_python_code_node",
 "guardrail_kind": [
  "sandbox_isolation"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [
   "CVE-2026-21858",
   "CVE-2026-21877",
   "CVE-2025-68668",
   "CVE-2025-68697"
  ],
  "ghsa": []
 },
 "primary_asi": "ASI05",
 "agent_framework": "n8n",
 "model_provider": "unknown",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "privilege_escalation",
 "eai_domain": "access_control_and_permissions",
 "eai_secondary": [],
 "eai_reason": "subcategory: Remote Code Execution & Sandbox Escape",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI05 (impact=code_exec); ASI03 (signal=identity)",
 "submitted_by": "EAI Internal"
}