n8n Python Code Node RCE (Critical)

A critical sandbox bypass vulnerability in n8n's Python Code Node that allows authenticated users to execute arbitrary operating system commands on the server.

## Vulnerability Overview
n8n's Python Code Node provides a sandboxed Python execution environment for workflow automation. This vulnerability allows an attacker to bypass the sandbox restrictions and execute arbitrary Python code with full access to the operating system, including spawning shell commands.

## Technical Details
- **Type:** Sandbox Bypass → RCE (CWE-94)
- **Root Cause:** The Python sandbox uses a restricted execution environment that blocks direct imports of dangerous modules (os, subprocess, etc.). However, the restriction can be bypassed using Python's __builtins__ manipulation, importlib, and ctypes to load arbitrary shared libraries and execute system calls.
- **Bypass Techniques:**
- `__import__('os').system('cmd')` is blocked
- `__builtins__.__import__('subprocess').check_output(['cmd'])` bypasses the block
- Using ctypes to directly call libc functions

## Impact
- Full RCE on the n8n server
- Arbitrary command execution with n8n service privileges
- Often root in Docker deployments