n8n-io n8n up to 1.123.7/2.1.x Environment Variable NODES_EXCLUDE code injection

Summaryinfo

A vulnerability identified as critical has been detected in n8n-io n8n up to 1.123.7/2.1.x. Affected by this issue is some unknown functionality of the component Environment Variable Handler. The manipulation of the argument NODES_EXCLUDE leads to code injection. This vulnerability is traded as CVE-2026-27498. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in n8n-io n8n up to 1.123.7/2.1.x and classified as critical. This issue affects some unknown functionality of the component Environment Variable Handler. The manipulation of the argument NODES_EXCLUDE with an unknown input leads to a code injection vulnerability. Using CWE to declare the problem leads to CWE-94. The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

n8n is an open source workflow automation platform. Prior to versions 2.2.0 and 1.123.8, an authenticated user with permission to create or modify workflows could chain the Read/Write Files from Disk node with git operations to achieve remote code execution. By writing to specific configuration files and then triggering a git operation, the attacker could execute arbitrary shell commands on the n8n host. The issue has been fixed in n8n versions 2.2.0 and 1.123.8. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations. Limit workflow creation and editing permissions to fully trusted users only, and/or disable the Read/Write Files from Disk node by adding `n8n-nodes-base.readWriteFile` to the `NODES_EXCLUDE` environment variable. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-27498 since 02/19/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1059 for this issue.

Upgrading to version 1.123.8 or 2.2.0 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 97365caf253978ba8e46d7bc53fa7ac3b6f67b32 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-0532). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• n8n n8n

Productinfo

Vendor

• n8n-io

Name

• n8n

Version

• 1.123.0
• 1.123.1
• 1.123.2
• 1.123.3
• 1.123.4
• 1.123.5
• 1.123.6
• 1.123.7
• 2.0
• 2.1

License

• open-source

Website

• Product: https://github.com/n8n-io/n8n/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion