CVE-2026-21893: n8n Command Injection Vulnerability in Community Package Installation
Summary
CVE-2026-21893: n8n Vulnerable to Command Injection in Community Package Installation. Affects n8n versions >= 0.187.0, < 1.120.3. Fixed in 1.120.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
n8n is an open-source workflow automation tool that allows users to connect various applications and services to automate tasks. It provides a user-friendly interface for creating workflows and supports the installation of community packages to extend its functionality. However, a critical vulnerability has been identified in its community package installation feature, which could allow unauthorized command execution under certain conditions.
Vulnerability Detail
A Command Injection vulnerability exists in n8n's community package installation functionality. This flaw allows authenticated users with administrative permissions to execute arbitrary system commands on the n8n host. Exploitation of this vulnerability requires administrative access, meaning only trusted users can potentially exploit it. While the vulnerability does not significantly expand the threat model beyond existing administrator capabilities, it violates secure coding practices and poses a risk to system integrity.
How To Fix
Latest published version: 2.44.6 as of 22 Oct 2026
npm install n8n@2.44.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.120.3
This is the first release that contains the fix.
npm install n8n@1.120.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, limit administrative access to trusted users only and ensure that community packages are installed solely from trusted sources. Regularly review user permissions and package sources to maintain security.
Conclusion
The Command Injection vulnerability in n8n's community package installation poses a significant risk to systems with administrative access. Users are strongly advised to upgrade to version 1.120.3 or later to mitigate this risk. Regular monitoring and adherence to security best practices are essential to maintain the integrity of n8n instances.
See every vulnerability recorded for n8n →
FAQ
The CVSS score of this vulnerability is 9.4, indicating a critical level of severity.
No, exploitation requires administrative access, so only authenticated users with the necessary permissions can exploit this vulnerability.
No, there is currently no evidence of exploitation in the wild.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against this vulnerability using the Vulert playground at Vulert Scanner without any signup.
If immediate upgrading is not possible, ensure that administrative access is restricted to trusted users and review community package sources to minimize risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for n8n.
