n8nGHSA-wxx7-mcgf-j869

n8n has Potential Remote Code Execution via Merge Node

CVE-2026-27497 · Published Feb 25, 2026 · updated Feb 28, 2026

Critical9.9

Fix: upgrade to 1.123.22 or later (3 fixed versions below)

Impact

An authenticated user with permission to create or modify workflows could leverage the Merge node's SQL query mode to execute arbitrary code and write arbitrary files on the n8n server.

Patches

The issues have been fixed in n8n versions 2.10.1, 2.9.3, and 1.123.22. Users should upgrade to one of these versions or later to remediate all known vulnerabilities.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

Limit workflow creation and editing permissions to fully trusted users only.
Disable the Merge node by adding n8n-nodes-base.merge to the NODES_EXCLUDE environment variable.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

Affected versions

Package	Affected	Fixed in
n8n npm	< 1.123.22	1.123.22
	>= 2.0.0, < 2.9.3	2.9.3
	>= 2.10.0, < 2.10.1	2.10.1

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Severity from: GitHub (reviewed advisory)
Weakness: CWE-89, CWE-94
Also known as: CVE-2026-27497

More n8n advisories

All n8n

High 5.4Feb 25

n8n Vulnerable to Stored XSS via Various NodesCVE-2026-27578fixed in 1.123.22 +2 Critical 9.9Feb 25

n8n: Expression Sandbox Escape Leads to RCECVE-2026-27577fixed in 1.123.22 +2 Critical 8.5Feb 25

n8n has Arbitrary Command Execution via File Write and Git OperationsCVE-2026-27498fixed in 1.123.8 +1 CriticalFeb 25

n8n has a Sandbox Escape in its JavaScript Task RunnerCVE-2026-27495fixed in 1.123.22 +2 High 9.9Feb 25

n8n has Arbitrary File Read via Python Code Node Sandbox EscapeCVE-2026-27494fixed in 1.123.22 +2 Critical 9.0Feb 25

n8n has Unauthenticated Expression Evaluation via Form NodeCVE-2026-27493fixed in 1.123.22 +2