GHSA-pf2q-pxhf-hgmw: n8n: Path-Confinement Bypass in computer-use search_files Allows Reading Files Outside the Base Directory

The search_files tool in @n8n/computer-use lets an AI agent find files, and read their contents, under a base directory the operator picked. The path-confinement check did not hold for every pattern. A crafted glob could expand to locations outside the base directory, and the tool returned matches from there.

The fix commit for this release line shows the shape of the problem. Glob patterns can expand to paths outside the base even when the pattern has no literal ... The patched tool drops any match that resolves outside the base, and does not read its contents, even when a content query is set. This comes from the public commit bundled into the 2.32.x release candidate, so treat it as context, not the advisory's own description.

Who can exploit it: any actor who can influence the tool's search input. In an agent setup that includes a user who can prompt the agent, and content the agent reads, such as a web page or document carrying injected instructions. The result is disclosure of arbitrary local files readable by the daemon's OS user, for example SSH keys, environment files and n8n config. The advisory's score reflects confidentiality loss only. It reports no integrity or availability impact.

The npm package n8n below 2.31.5, and 2.32.0. The advisory lists no 1.x range. It applies only to deployments that use the @n8n/computer-use file-search tool.

npm ls n8n
npm ls -g @n8n/computer-use

Check which OS account runs the computer-use daemon, since that account's file permissions set how much can be read.

Upgrade n8n to 2.31.5 or 2.32.1, or later.

Temporary measures from the advisory, which it says do not fully remove the risk:

• Limit instance access to fully trusted users.
• Turn off or remove AI agent workflows that use the computer-use package until you patch.
• Run the n8n process under a dedicated low-privilege account, so fewer files are readable outside the base directory.

Review the search_files calls made by your computer-use agents. Look for patterns that use unusual glob syntax, that start with / or ~, or that resolve to paths such as .ssh, .env, /etc or cloud credential directories. Check the agent's tool results in execution logs for file names or contents from outside the base directory. Compare file-access audit records for the daemon's OS user against its expected working directory.

If an agent runs under Beam, its records of agent file access and tool calls can show what the tool read, and the rules can flag reads of sensitive paths.

Impact

The component @n8n/computer-use file-search tool confined searches to a configured base directory. A crafted search pattern could bypass the confinement check and expand to locations outside that directory, causing the tool to return the names and contents of files anywhere the daemon's OS user could read. Any deployment where an actor could influence the tool's search input was affected; the result was disclosure of arbitrary local files outside the intended sandbox.

Patches

The issue has been fixed in n8n versions 2.31.5 and 2.32.1. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

• Restrict n8n instance access to fully trusted users only.
• Disable or remove AI agent workflows that use the computer-use package until the instance is patched.
• Ensure the n8n process runs under a dedicated low-privilege user account to limit the files accessible outside the sandbox.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.