Executive brief
n8n is a popular workflow automation platform. An authenticated administrator can inject and execute arbitrary system commands on the n8n server through the community package installation feature. While this requires administrative access, it allows attackers with that level of privilege to compromise the underlying system.
Technical details
A command injection vulnerability exists in n8n's community package installation functionality (CWE-78, CWE-20). The vulnerable component fails to properly sanitize user-supplied input when constructing OS commands for package installation. Exploitation requires an authenticated user with administrative permissions; unauthenticated users cannot exploit this. An attacker with admin access can inject shell metacharacters to execute arbitrary commands with the privileges of the n8n process. The vulnerability is patched in version 1.120.3 and later.
Affected products
- n8n n8n 0.187.0 to 1.120.2
Timeline
- 2026-02-04: disclosed: GHSA-7c4h-vh2m-743m published
- 2026-02-04: patched: Patch available in version 1.120.3