n8n Vulnerable to RCE via Arbitrary File Write
Critical9.9CVE-2026-21877 · Published Jan 6, 2026 · updated Feb 3, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| n8n npm | >= 0.123.0, < 1.121.3 | 1.121.3 |
Details and references
### Impact n8n is affected by an authenticated Remote Code Execution (RCE) vulnerability. Under certain conditions, an authenticated user may be able to cause untrusted code to be executed by the n8n service. This could result in full compromise of the affected instance. Both self-hosted and n8n Cloud instances are impacted. ### Patches The issue has been resolved in n8n version 1.121.3. Users are advised to upgrade to this version or later to fully address the vulnerability. ### Workarounds If upgrading is not immediately possible, administrators can reduce exposure by disabling the Git node and limiting access for untrusted users. ### References - n8n documentation: [Blocking access to nodes](https://docs.n8n.io/hosting/securing/blocking-nodes/)
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-434
- Also known as
- CVE-2026-21877
More n8n advisories
All n8n| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jan 7 | n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling CVE-2026-21858Critical10.0fixed in 1.121.0 | Critical10.0 | 1.121.0 |
| Jan 7 | n8n's Missing Stripe-Signature Verification Allows Unauthenticated Forged Webhooks CVE-2026-21894Medium6.5fixed in 2.2.2 | Medium6.5 | 2.2.2 |
| Jan 13 | n8n: Webhook Node IP Whitelist Bypass via Partial String Matching CVE-2025-68949Medium5.3fixed in 2.2.0 | Medium5.3 | 2.2.0 |
| Dec 262025 | Self-hosted n8n has Legacy Code node that enables arbitrary file read/write CVE-2025-68697High7.1fixed in 2.0.0 | High7.1 | 2.0.0 |
| Dec 262025 | n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Node CVE-2025-68668Critical9.9fixed in 2.0.0 | Critical9.9 | 2.0.0 |
| Dec 262025 | n8n's Possible Stored XSS in "Respond to Webhook" Node May Execute Outside iframe Sandbox CVE-2025-61914High7.3fixed in 1.114.0 | High7.3 | 1.114.0 |