CVE-2026-21893CWE-20CWE-78

n8n Vulnerable to Command Injection in Community Package Installation

Critical · published February 4, 2026

CVSS v4.0
9.4
EPSS
2%
Percentile
75.0
In the wild
Unconfirmed
What it is

n8n is an open source workflow automation platform. From version 0.187.0 to before 1.120.3, a command injection vulnerability was identified in n8n’s community package installation functionality. The issue allowed authenticated users with administrative permissions to execute arbitrary system commands on the n8n host under specific conditions. This issue has been patched in version 1.120.3.

The record
Technical detail
CVSS v4.0
9.4 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.01560 · 75.0th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-02-04T17:36Z
EPSS history
Timeline
  • 04 FEB 17:36Z
    n8n Vulnerable to Command Injection in Community Package Installation
    cvelistv5