Remote Command Execution Vulnerability in n8n-nodes-metricsagent Package
Summary
MAL-2026-16445: Malicious code in n8n-nodes-metricsagent (npm). Affects n8n-nodes-metricsagent versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The n8n-nodes-metricsagent package is an npm module designed to integrate with the n8n workflow automation tool, providing metrics and monitoring capabilities. It is intended to facilitate the collection and reporting of various metrics from workflows. However, this package has been found to contain a critical vulnerability that allows for arbitrary command execution, posing a significant security risk to systems using it.
Vulnerability Detail
The vulnerability originates from a postinstall lifecycle script defined in the package's package.json file, which executes a script that sets up an HTTP server on port 41111. This server accepts POST requests and executes commands sent in the request body without any authentication or validation. As a result, any user with network access to the server can execute arbitrary commands as the user running the npm install command. This flaw allows attackers to gain control over the host system, potentially leading to data breaches or further exploitation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall n8n-nodes-metricsagentIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can prevent the execution of the postinstall script by using the following command when installing the package: npm install n8n-nodes-metricsagent --ignore-scripts. This will prevent the malicious server from being set up, but it is recommended to update the package as soon as a fix is available.
Conclusion
The n8n-nodes-metricsagent package has a critical vulnerability that allows for remote command execution, posing a serious threat to systems using it. It is crucial to update the package to a patched version or implement workarounds to mitigate the risk. Regular monitoring of dependencies is essential for maintaining security.
See every vulnerability recorded for n8n-nodes-metricsagent →
FAQ
It is an npm module designed for integrating metrics and monitoring capabilities into the n8n workflow automation tool.
The package contains a remote command execution vulnerability that allows unauthorized users to execute arbitrary commands on the host system.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground at Vulert Scanner without needing to sign up.
As a temporary measure, you can install the package with the --ignore-scripts flag to prevent the execution of the malicious postinstall script.
Utilizing tools like Vulert can help you monitor your dependencies for vulnerabilities in real-time, ensuring you are alerted to any issues promptly.
