CVE-2026-77068CWE-22path-traversal

CVE-2026-77068

High · published August 20, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
60.2
In the wild
Unconfirmed
What it is

n8n before 2.33.4 and 2.34.x before 2.34.1 contain a remote code execution vulnerability in the @n8n/workflow-sdk node-schema loader used for MCP node-schema loading. The loader derives a node's schema module path directly from the attacker-supplied node type string without validating path-traversal sequences. An authenticated user with global:member privileges can reference malicious files via path traversal, causing code execution in the n8n main process.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00930 · 60.2th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-08-20T16:16Z
Affected products (2)
ProductVersionsFixed in
n8n/n8n≥ 2.33.0, < 2.33.42.33.4
n8n/n8nall versions—
References (2)
https://github.com/n8n-io/n8n/security/advisories/GHSA-6h4x-896x-fw5m · [email protected]https://www.vulncheck.com/advisories/n8n-before-remote-code-execution-via-path-traversal · [email protected]
EPSS history
Timeline
  • 20 AUG 11:21Z
    n8n before 2.34.1 Remote Code Execution via Path Traversal
    cvelistv5