Executive brief
n8n is a workflow automation platform that includes an Execute Command node designed for advanced automation tasks. This node allows any authenticated user to run arbitrary commands on the underlying host system where n8n is deployed. A malicious insider or attacker who compromises a legitimate user account can exploit this to gain full control of the server, steal sensitive data, disrupt operations, or use the compromised system as a launching point for further attacks.
Technical details
The Execute Command node in n8n (CWE-284: Improper Access Control) enables authenticated users to execute arbitrary operating system commands on the host machine without additional authorization checks. The vulnerability requires authentication (PR:L) and network reachability, but no user interaction. An attacker with a valid n8n account can chain this node into any workflow to execute shell commands with the privileges of the n8n process, leading to confidentiality, integrity, and availability compromise. No code patch has been issued; the vendor recommends disabling the Execute Command node by default using the NODES_EXCLUDE environment variable in untrusted multi-user environments. n8n.cloud is not affected as it implements separate security controls.
Affected products
- n8n n8n All versions up to 1.114.4
- n8n n8n-nodes-base All versions up to 1.113.0
Timeline
- 2025-10-09: disclosed: GHSA-365g-vjw2-grx8 published