~ / search / GHSA-v364-rw7m-3263

GHSA-v364-rw7m-3263

n8n Vulnerable to RCE via Arbitrary File Write

Source: GitHub Advisory Database (reviewed) Critical CVE-2026-21877

Packages

EcosystemPackageAffectedFixed in
npm n8n >= 0.123.0, < 1.121.3 1.121.3

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact n8n is affected by an authenticated Remote Code Execution (RCE) vulnerability. Under certain conditions, an authenticated user may be able to cause untrusted code to be executed by the n8n service. This could result in full compromise of the affected instance. Both self-hosted and n8n Cloud instances are impacted. ### Patches The issue has been resolved in n8n version 1.121.3. Users are advised to upgrade to this version or later to fully address the vulnerability. ### Workarounds If upgrading is not immediately possible, administrators can reduce exposure by disabling the Git node and limiting access for untrusted users. ### References - n8n documentation: [Blocking access to nodes](https://docs.n8n.io/hosting/securing/blocking-nodes/)

References

External links from the advisory. They lead to third-party sites.