Executive brief
n8n is a workflow automation platform that lets users visually build and orchestrate business processes and integrations. An authenticated attacker can exploit an arbitrary file write vulnerability to execute malicious code on the n8n server, potentially gaining complete control of the instance and accessing all data it processes. This affects both self-hosted and cloud instances.
Technical details
The vulnerability is a file upload vulnerability (CWE-434) allowing authenticated users to write arbitrary files and achieve remote code execution. The Git node is specifically mentioned as the vulnerable component, suggesting the flaw exists in how n8n processes file operations within workflow nodes. Attack requires valid credentials (authenticated user), network access to the n8n instance, and no user interaction beyond normal API interaction. An attacker can cause untrusted code to execute in the context of the n8n service, achieving full instance compromise. Patched in version 1.121.3; workarounds include disabling the Git node and restricting access to untrusted users.
Affected products
- n8n n8n >=0.123.0, <1.121.3
Timeline
- 2026-01-06: disclosed
- 2026-01-06: patched: Version 1.121.3 released