AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-x2mw-7j39-93xq: n8n has Arbitrary Command Execution via File Write and Git Operations

criticalvulnerability

security

Source: GitHub Advisory DatabaseFebruary 25, 2026CVE-2026-27498

Summary

n8n (a workflow automation tool) has a vulnerability where an authenticated user with workflow editing permissions could combine the Read/Write Files from Disk node (a component that modifies files on the server) with git operations (version control commands) to execute arbitrary shell commands (any commands an attacker chooses) on the n8n server. This requires the attacker to already have valid user access.

Solution / Mitigation

The issue has been fixed in n8n versions 2.2.0 and 1.123.8. Users should upgrade to one of these versions or later. If upgrading is not immediately possible, administrators can temporarily: (1) Limit workflow creation and editing permissions to fully trusted users only, or (2) Disable the Read/Write Files from Disk node by adding `n8n-nodes-base.readWriteFile` to the `NODES_EXCLUDE` environment variable. The source notes these workarounds do not fully remediate the risk and should only be short-term measures.