Vulnerability · Published Feb 4, 2026 · Assigned by GitHub_M

CVE-2026-21893n8n Vulnerable to Command Injection in Community Package Installation

Critical 9.4

In plain English

A critical-severity OS command injection in n8n from n8n-io. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)9.4Critical

Exploit odds (30 days)1.5%top 25.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

n8n is an open source workflow automation platform. From version 0.187.0 to before 1.120.3, a command injection vulnerability was identified in n8n’s community package installation functionality. The issue allowed authenticated users with administrative permissions to execute arbitrary system commands on the n8n host under specific conditions. This issue has been patched in version 1.120.3.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	n8n	1.120.3	GHSA-7c4h-vh2m-743m

Affected products (as reported)

Vendor	Product	Versions
n8n-io	n8n	>= 0.187.0, < 1.120.3

Weakness: CWE-78, CWE-20 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://github.com/n8n-io/n8n/security/advisories/GHSA-7c4h-vh2m-743m x_refsource_CONFIRM
https://github.com/n8n-io/n8n/commit/ae0669a736cc496beeb296e115267862727ae838 x_refsource_MISC