Critical · published February 4, 2026
🚨 A crafty flaw in n8n's Merge node lets authenticated users write arbitrary files to the server! 🔥 Think of it as a sneaky waiter who can write any order they want on the menu, potentially serving up something dangerous instead of your pasta. This vulnerability allows users to manipulate the server's filesystem just like that waiter altering orders behind the scenes. An attacker could exploit this vulnerability to upload malicious files or even execute arbitrary code on the server, leading to a complete system compromise. Imagine the chaos if someone could run their own scripts on your server — it could spell disaster for your workflows and data integrity!
Think of it as a sneaky waiter who can write any order they want on the menu, potentially serving up something dangerous instead of your pasta. This vulnerability allows users to manipulate the server's filesystem just like that waiter altering orders behind the scenes. This vulnerability in n8n's SQL Query mode of the Merge node allows authenticated users with the right permissions to write files directly to the server's filesystem, which could lead to remote code execution.
An attacker could exploit this vulnerability to upload malicious files or even execute arbitrary code on the server, leading to a complete system compromise. Imagine the chaos if someone could run their own scripts on your server — it could spell disaster for your workflows and data integrity! Update your n8n instance to versions 1.118.0 or 2.4.0 immediately to close this critical vulnerability. Additionally, review user permissions to ensure only trusted users can create or modify workflows. Regularly monitor your workflows for any suspicious activity. You've got this! By following these steps, you're well on your way to securing your n8n environment! 🛡️