CVE-2026-27498
n8n has Arbitrary Command Execution via File Write and Git Operations
Impact
## Impact An authenticated user with permission to create or modify workflows could chain the Read/Write Files from Disk node with git operations to achieve remote code execution. By writing to specific configuration files and then triggering a git operation, the attacker could execute arbitrary shell commands on the n8n host. ## Patches The issue has been fixed in n8n versions 2.2.0 and 1.123.8. Users should upgrade to one of these versions or later to remediate the vulnerability. ## Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Limit workflow creation and editing permissions to fully trusted users only. - Disable the Read/Write Files from Disk node by adding `n8n-nodes-base.readWriteFile` to the `NODES_EXCLUDE` environment variable. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | n8n | < 1.123.8 | 1.123.8 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| N8n | N8n | before 1.123.8 from 2.0.0 before 2.2.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/n8n-io/n8n/commit/97365caf253978ba8e46d7bc53fa7ac3b6f67b32
- https://github.com/n8n-io/n8n/commit/e22acaab3dcb2004e5fe0bf9ef2db975bde61866
- https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.8
- https://github.com/n8n-io/n8n/releases/tag/n8n@2.2.0
- https://github.com/n8n-io/n8n/security/advisories/GHSA-x2mw-7j39-93xq
- https://github.com/advisories/GHSA-x2mw-7j39-93xq
- https://nvd.nist.gov/vuln/detail/CVE-2026-27498