n8n hat Arbitrary Command Execution via File Write und Git Operations

This vulnerability allows an authenticated attacker to gain complete control over the n8n server. By crafting malicious workflows that leverage the Read/Write Files from Disk node and subsequent git operations, an attacker can inject and execute arbitrary shell commands. The impact is significant, potentially leading to data breaches, system compromise, and complete takeover of the affected n8n instance. The ability to execute commands directly on the server bypasses typical security controls and represents a severe risk, especially in environments where n8n handles sensitive data or integrates with critical systems. Successful exploitation could allow an attacker to steal credentials, modify workflows, or even pivot to other systems on the network.

Organizations using n8n for workflow automation, particularly those handling sensitive data or integrating with critical systems, are at risk. Environments with overly permissive user roles or those lacking robust security monitoring are especially vulnerable. Shared hosting environments where multiple users share an n8n instance are also at increased risk.

• nodejs / server: Monitor n8n logs for unusual file creation or modification patterns within the Read/Write Files from Disk node directory. Look for suspicious git commands being executed.

find /path/to/n8n/data/ -mmin -60 -type f -print0 | xargs -0 grep -i 'malicious_command'

• nodejs / server: Use ps or top to monitor processes running within the n8n container for unexpected command-line arguments or resource consumption.

ps aux | grep n8n

• generic web: Check n8n workflow configurations for suspicious file paths or commands that could be exploited. Review user permissions to ensure least privilege access.

1. 2026-02-25Disclosure

   disclosure

1. Reserviert2026-02-19
2. Veröffentlicht2026-02-25
3. Geändert2026-02-28
4. EPSS aktualisiert2026-03-23

The primary mitigation is to upgrade n8n to version 1.123.8 or 2.2.0 or later. If immediate upgrading is not feasible, administrators should restrict user permissions to minimize the potential attack surface. Specifically, limit users' ability to create or modify workflows, and carefully review existing workflows for suspicious activity. Consider implementing a Web Application Firewall (WAF) with rules to detect and block malicious workflow configurations attempting to execute shell commands. Regularly audit n8n configurations and user permissions to ensure adherence to security best practices.