n8n has Potential Remote Code Execution via Merge Node
Critical9.9CVE-2026-27497 · Published Feb 25, 2026 · updated Feb 28, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| n8n npm | < 1.123.22 | 1.123.22 |
| >= 2.0.0, < 2.9.3 | 2.9.3 | |
| >= 2.10.0, < 2.10.1 | 2.10.1 |
Details and references
## Impact An authenticated user with permission to create or modify workflows could leverage the Merge node's SQL query mode to execute arbitrary code and write arbitrary files on the n8n server. ## Patches The issues have been fixed in n8n versions 2.10.1, 2.9.3, and 1.123.22. Users should upgrade to one of these versions or later to remediate all known vulnerabilities. ## Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Limit workflow creation and editing permissions to fully trusted users only. - Disable the Merge node by adding `n8n-nodes-base.merge` to the `NODES_EXCLUDE` environment variable. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
More n8n advisories
All n8n| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Feb 25 | n8n has Unauthenticated Expression Evaluation via Form Node CVE-2026-27493Critical9.0fixed in 1.123.22, 2.9.3, 2.10.1 | Critical9.0 | 1.123.22, 2.9.3, 2.10.1 |
| Feb 25 | n8n has Arbitrary File Read via Python Code Node Sandbox Escape CVE-2026-27494High9.9fixed in 1.123.22, 2.9.3, 2.10.1 | High9.9 | 1.123.22, 2.9.3, 2.10.1 |
| Feb 25 | n8n has a Sandbox Escape in its JavaScript Task Runner CVE-2026-27495Criticalfixed in 1.123.22, 2.9.3, 2.10.1 | Critical | 1.123.22, 2.9.3, 2.10.1 |
| Feb 25 | n8n has Arbitrary Command Execution via File Write and Git Operations CVE-2026-27498Critical8.5fixed in 1.123.8, 2.2.0 | Critical8.5 | 1.123.8, 2.2.0 |
| Feb 25 | n8n: Expression Sandbox Escape Leads to RCE CVE-2026-27577Critical9.9fixed in 1.123.22, 2.9.3, 2.10.1 | Critical9.9 | 1.123.22, 2.9.3, 2.10.1 |
| Feb 25 | n8n Vulnerable to Stored XSS via Various Nodes CVE-2026-27578High5.4fixed in 1.123.22, 2.9.3, 2.10.1 | High5.4 | 1.123.22, 2.9.3, 2.10.1 |