GHSA-2vx9-7wpg-88jq: n8n: Legacy ExecuteWorkflow Node Bypassed File Path Restrictions

Summary

The ExecuteWorkflow node's legacy localFile source option read workflow files from disk without the checks other file-reading nodes apply, letting an authenticated user with workflow create or modify permission supply arbitrary paths through the REST API and bypass N8N_RESTRICT_FILE_ACCESS_TO. The flaw lets an attacker probe whether arbitrary files exist on the host, and a valid workflow JSON file at the path could be loaded and executed, potentially triggering actions on connected downstream systems. The option is hidden from the UI since v1.2 but remains reachable via the API.

Mitigation

Fixed in n8n 2.20.0 or 2.19.3; upgrade to these or later. If upgrading is not immediately possible, restrict workflow creation and editing permissions to fully trusted users only and restrict network access to the n8n REST API to trusted users only. The source states these workarounds do not fully remediate the risk and are short-term measures only.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• n8nnpmDeclares an LLM dependency

Related items

• MediumCVE-2026-102610: fast-agent serve unauthenticated remote command execution via /mcp endpointSimilar attack · NVD/CVE Database
• CriticalCVE-2026-58490: Tracecat SAML authentication bypass through unsigned responses in Docker ComposeSimilar attack · NVD/CVE Database
• MediumCVE-2026-124028: mistral.rs delimiter injection allows attacker-chosen tool calls via quoted textSimilar attack · NVD/CVE Database
• HighCVE-2026-123974: TorchServe local privilege escalation via predictable /tmp extraction directorySimilar attack · NVD/CVE Database
• InfoOpenAI Says New GPT-6 Cyber Model Hunts Flaws Without Crossing the LineSimilar attack · SecurityWeek