PT-2026-6100 · N8N · N8N

Berkdedekarginoglu · Published 2026-02-04 · Updated 2026-02-05 · CVE-2026-21893

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions n8n versions 0.187.0 through 1.120.2

Description n8n is a workflow automation platform. A command injection issue was identified in the community package installation functionality. This allowed authenticated users with administrative permissions to execute arbitrary system commands on the n8n host under specific conditions. The issue was present in versions from 0.187.0 up to, but not including, 1.120.3. The vulnerability allows for potential privilege escalation from administrator to root. The vulnerable functionality involves the package installation process, lacking sufficient input sanitization.

Recommendations Update to version 1.120.3 or later.

Exploit

Fix

LPE

OS Command Injection

RCE

Weakness Enumeration

CWE-78

CWE-20

Related Identifiers

CVE-2026-21893

GHSA-7C4H-VH2M-743M

Affected Products

N8N

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21893.json · Exploit
• https://github.com/n8n-io/n8n/commit/ae0669a736cc496beeb296e115267862727ae838 · Patch
• https://github.com/n8n-io/n8n/security/advisories/GHSA-7c4h-vh2m-743m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-21893 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21893 · Security Note
• https://osv.dev/vulnerability/GHSA-7c4h-vh2m-743m · Vendor Advisory
• https://github.com/n8n-io/n8n · Note
• https://twitter.com/0dayPublishing/status/2019107808151519734 · Twitter Post
• https://twitter.com/pulsepatchio/status/2019427100206460942 · Twitter Post
• https://twitter.com/_cvereports/status/2019111235539656900 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2019147314938409137 · Twitter Post