Listen to this Post
The vulnerability (CVE-2026-XXXXX) is an authenticated Remote Code Execution flaw stemming from an arbitrary file write primitive. An attacker with authenticated access to the n8n instance can exploit a flaw in the handling of the Git node or related file operations. By crafting a specific payload, they can write arbitrary files to the server’s filesystem. This includes writing malicious JavaScript or configuration files into key directories that are later executed by the n8n application in a server context. The write operation bypasses intended security controls, allowing the attacker to plant a file that the application loads as code. When n8n subsequently executes its normal workflow or triggers a node that loads the planted file, the embedded malicious code runs with the privileges of the n8n service, leading to full system compromise and remote command execution on the underlying host.
Platform: n8n
Version: <1.121.3
Vulnerability: Authenticated RCE
Severity: Critical
date: Jan 6 2026
Prediction: Patch released
What Undercode Say:
Analytics
find / -name "n8n" -type d 2>/dev/null curl -s http://localhost:5678/rest/health | grep version cat /home/n8n/.n8n/config 2>/dev/null | grep key ps aux | grep node | grep n8n
// Potential payload structure for file write
const fs = require('fs');
fs.writeFileSync('/path/to/n8n/config/evil.js', 'require("child_process").exec("id")');
How Exploit
Authenticated user access.
Abuse Git node.
Write malicious file.
Trigger execution path.
Protection from this CVE
Upgrade to v1.121.3.
Disable Git node.
Restrict user access.
Impact
Full system compromise.
Data breach.
Service disruption.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
