-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| n8n-nodes-base | npm | <= 1.113.0 | |
| n8n | npm | <= 1.114.4 |
Miggo AIRoot Cause AnalysisThe vulnerability, GHSA-365g-vjw2-grx8, is a command injection vulnerability in the 'Execute Command' node of n8n. The advisory states that this is an intended functionality and the recommended mitigation is to disable the node, rather than patching the code. My analysis of the source code for the ExecuteCommand.node.ts file confirms this. The ExecuteCommand.execute method is the entry point that retrieves the user-supplied command. This command is then passed to the execPromise function, which uses child_process.exec to execute it on the underlying operating system. There is no sanitization or validation performed on the command, which means any authenticated user with permissions to use this node can execute arbitrary commands on the n8n server. This can lead to a full system compromise. The functions ExecuteCommand.execute and execPromise are the key functions that would appear in a runtime profile when this vulnerability is triggered.
Access the latest Benchmark Study of WAF Weaknesses and AI Mitigation