Executive brief
n8n is a workflow automation platform that allows users to create automation workflows. An authenticated user with workflow creation/editing permissions can exploit a vulnerability in the Read/Write Files from Disk node to write malicious configuration files, then chain this with git operations to execute arbitrary shell commands on the n8n server, potentially compromising the entire system.
Technical details
This vulnerability allows for arbitrary command execution through a combination of unsafe file write operations and git command execution. An authenticated attacker with permissions to create or modify workflows can use the Read/Write Files from Disk node to write to sensitive configuration files, then trigger git operations that interpret these files, leading to arbitrary shell command execution. The attack requires authentication and workflow modification permissions but exploits the lack of proper input validation or command injection protections in how git operations are invoked. Patches are available in n8n versions 1.123.8 and 2.2.0.
Affected products
- n8n n8n <1.123.8, >=2.0.0 <2.2.0
Timeline
- 2026-02-25: disclosed
- 2026-02-25: patched: Fixed in versions 1.123.8 and 2.2.0