CVE-2026-21877

CRITICAL NUCLEI

N8n < 1.121.3 - Code Injection

Title source: rule

Description

n8n is an open source workflow automation platform. In versions 0.121.2 and below, an authenticated attacker may be able to execute malicious code using the n8n service. This could result in full compromise and can impact both self-hosted and n8n Cloud instances. This issue is fixed in version 1.121.3. Administrators can reduce exposure by disabling the Git node and limiting access for untrusted users, but upgrading to the latest version is recommended.

Exploits (1)

nomisec WORKING POC

by CVEs-Labs · poc

https://github.com/CVEs-Labs/CVE-2026-21877

View Code ZIP pw:eip

Nuclei Templates (1)

n8n >= 0.123.0 and < 1.121.3 - Remote Code Execution

CRITICALVERIFIEDby s4e-io

Shodan: http.favicon.hash:-831756631

FOFA: icon_hash="-831756631"

References (2)

[Patch] https://github.com/n8n-io/n8n/commit/f4b009d00d1f4ba9359b8e8f1c071e3d910a55f6

View Patch ZIP pw:eip

[Vendor Advisory] https://github.com/n8n-io/n8n/security/advisories/GHSA-v364-rw7m-3263

Scores

CVSS v3 9.9

EPSS 0.1414

EPSS Percentile 94.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Details

CWE

CWE-434 CWE-94

Status published

Products (2)

n8n/n8n 0.123.0 - 1.121.3

npm/n8n 0.123.0 - 1.121.3npm

Published Jan 08, 2026

Tracked Since Feb 18, 2026