CVE-2026-21893 CRITICAL

CVE-2026-21893: n8n Vulnerable to Command Injection in Community Package Installation

Vendor N8N-Io
Product n8n
Weakness CWE-78
Published February 4, 2026
Last update February 4, 2026
View on NVD All CVEs

CVSS base score

9.4/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

What the vulnerability does

01Description

n8n is an open source workflow automation platform. From version 0.187.0 to before 1.120.3, a command injection vulnerability was identified in n8n’s community package installation functionality. The issue allowed authenticated users with administrative permissions to execute arbitrary system commands on the n8n host under specific conditions. This issue has been patched in version 1.120.3.

Key dates

02Disclosure timeline

February 4, 2026 CVE published
February 4, 2026 Record updated