9.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25056

CVE-2026-25056: n8n Arbitrary File Write leading to RCE in n8n Merge Node

n8n is an open source workflow automation platform. Prior to versions 1.118.0 and 2.4.0, a vulnerability in the Merge node's SQL Query mode allowed authenticated users with permission to create or modify workflows to write arbitrary files to the n8n server's filesystem potentially leading to remote code execution. This issue has been patched in versions 1.118.0 and 2.4.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25056

CVE-2026-25056:

9.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
n8n	npm	< 1.118.0	1.118.0
n8n	npm	>= 2.0.0, < 2.4.0	2.4.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the "SQL Query" mode of the n8n Merge node. Authenticated users with permissions to edit workflows could provide a malicious SQL query that leverages file-writing functions within the alasql library, which was used to process these queries. The root cause of the vulnerability was the failure to disable these dangerous, built-in alasql functions, such as SAVE(), which could be used to write files to the local filesystem of the n8n server. The analysis of the security patch clearly shows the introduction of a new function, disableAlasqlFileAccess, which explicitly overrides and disables these file system-related functions in alasql. This function is then called at the entry point of the execute function for the combineBySql operation, effectively neutralizing the vulnerability. Therefore, the combineBySql.execute function is the primary vulnerable function, as it was the entry point for processing the malicious input.

Vulnerable functions

combineBySql.execute

packages/nodes-base/nodes/Merge/v3/actions/mode/combineBySql.ts

The `execute` function within the `combineBySql` mode of the Merge node was vulnerable to an arbitrary file write. It used the `alasql` library to execute user-provided SQL queries. The vulnerability existed because file access functions within `alasql` (e.g., `SAVE()`) were not disabled, allowing a user with permissions to create or modify workflows to craft a malicious SQL query to write arbitrary files to the server's filesystem. This could lead to Remote Code Execution (RCE). The patch mitigates this by explicitly disabling these dangerous file access functions before executing the user's query.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.