by Kastro
Paper/Archive/CVE-2026-21893

CVE-2026-21893

n8n-io n8n — n8n Vulnerable to Command Injection in Community Package Installation

EPSS 2%CVSS 9.4
critical.is priorityof 100
43
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 74.9.749 × 2015.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

n8n is an open source workflow automation platform. From version 0.187.0 to before 1.120.3, a command injection vulnerability was identified in n8n’s community package installation functionality. The issue allowed authenticated users with administrative permissions to execute arbitrary system commands on the n8n host under specific conditions. This issue has been patched in version 1.120.3.

Affected

ProductAffectedFixed inSource
n8n>= 0.187.0, < 1.120.3–CNA

Scores by source

GitHub_M (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/n8n-io/n8n/security/advisories/GHSA-7c4h-vh2m-743mrefgithub.com/n8n-io/n8n/commit/ae0669a736cc496beeb296e115267862727ae838