Vulnerability · Published Jan 8, 2026 · Assigned by GitHub_M
CVE-2026-21877n8n is vulnerable to Remote Code Execution via Arbitrary File Write
Critical 10.0
In plain English
A critical-severity code injection in n8n from n8n-io. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.4% (higher than 93% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
n8n is an open source workflow automation platform. In versions 0.121.2 and below, an authenticated attacker may be able to execute malicious code using the n8n service. This could result in full compromise and can impact both self-hosted and n8n Cloud instances. This issue is fixed in version 1.121.3. Administrators can reduce exposure by disabling the Git node and limiting access for untrusted users, but upgrading to the latest version is recommended.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | n8n | 1.121.3 | GHSA-v364-rw7m-3263 |
Affected products (as reported)
Weakness: CWE-94, CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References
- https://github.com/n8n-io/n8n/security/advisories/GHSA-v364-rw7m-3263 x_refsource_CONFIRM
- https://github.com/n8n-io/n8n/commit/f4b009d00d1f4ba9359b8e8f1c071e3d910a55f6 x_refsource_MISC