Advisoriesby Ibisn8nGHSA-v364-rw7m-3263
n8n Vulnerable to RCE via Arbitrary File Write
Fix: upgrade to 1.121.3 or later
Impact
n8n is affected by an authenticated Remote Code Execution (RCE) vulnerability.
Under certain conditions, an authenticated user may be able to cause untrusted code to be executed by the n8n service. This could result in full compromise of the affected instance.
Both self-hosted and n8n Cloud instances are impacted.
Patches
The issue has been resolved in n8n version 1.121.3.
Users are advised to upgrade to this version or later to fully address the vulnerability.
Workarounds
If upgrading is not immediately possible, administrators can reduce exposure by disabling the Git node and limiting access for untrusted users.
References
- n8n documentation: [Blocking access to nodes](https://docs.n8n.io/hosting/securing/blocking-nodes/)
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| n8n npm | >= 0.123.0, < 1.121.3 | 1.121.3 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-434
- Also known as
- CVE-2026-21877
More n8n advisories
All n8n
n8n: Webhook Node IP Whitelist Bypass via Partial String MatchingCVE-2025-68949fixed in 2.2.0n8n's Missing Stripe-Signature Verification Allows Unauthenticated Forged WebhooksCVE-2026-21894fixed in 2.2.2n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request HandlingCVE-2026-21858fixed in 1.121.0Self-hosted n8n has Legacy Code node that enables arbitrary file read/writeCVE-2025-68697fixed in 2.0.0n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code NodeCVE-2025-68668fixed in 2.0.0n8n's Possible Stored XSS in "Respond to Webhook" Node May Execute Outside iframe SandboxCVE-2025-61914fixed in 1.114.0