9.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-21877

CVE-2026-21877: n8n is vulnerable to Remote Code Execution via Arbitrary File Write

n8n is an open source workflow automation platform. In versions 0.121.2 and below, an authenticated attacker may be able to execute malicious code using the n8n service. This could result in full compromise and can impact both self-hosted and n8n Cloud instances. This issue is fixed in version 1.121.3. Administrators can reduce exposure by disabling the Git node and limiting access for untrusted users, but upgrading to the latest version is recommended.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-21877

CVE-2026-21877:

9.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
n8n	npm	>= 0.123.0, < 1.121.3	1.121.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the 'Git' node of n8n, where an authenticated user could perform an arbitrary file write, leading to Remote Code Execution (RCE). The advisory points to the 'Git node' as the source of the vulnerability. Analysis of the patch commits reveals that the fix was implemented in the Git.execute method within packages/nodes-base/nodes/Git/Git.node.ts. The patch adds a check to validate the repositoryPath parameter to ensure it is not a blocked or restricted path. The vulnerable function is Git.execute because it is the entry point for the node's execution and it's where the unsanitized user input (repositoryPath) was used to perform file system operations. The added check isFilePathBlocked in the patched code confirms that this was the location of the vulnerability.

Vulnerable functions

Git.execute

packages/nodes-base/nodes/Git/Git.node.ts

The `execute` method in the `Git` node is vulnerable. Before the patch, it did not validate the `repositoryPath` parameter, which could be controlled by a user. This allowed an authenticated user to specify an arbitrary path on the file system where a git repository would be cloned. This arbitrary file write could be leveraged for Remote Code Execution (RCE). The patch introduces a check using `isFilePathBlocked` to validate the `repositoryPath` and prevent writing to restricted locations.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.