A critical vulnerability in the n8n workflow automation platform allows authenticated users to achieve remote code execution through arbitrary file writes.

The vulnerability exists within the Merge node's SQL Query mode, where insufficient input validation permits authenticated users with workflow modification permissions to write arbitrary files to the server filesystem. This flaw, categorized under CWE-434 and CWE-693, facilitates remote code execution by bypassing intended security protections.

The ability to write arbitrary files to the host filesystem poses a severe risk to organizational infrastructure, as attackers can deploy malicious scripts or configuration files to gain full control over the n8n instance. With a CVSS score of 8.8, this vulnerability is considered High, as it enables complete system compromise, potential data exfiltration, and disruption of critical automated business workflows.

Immediate Action: Update the n8n instance to version 1.118.0 or 2.4.0 immediately to resolve the vulnerable file write capability.

Proactive Monitoring: Review workflow logs for unauthorized or suspicious SQL queries, particularly those interacting with the Merge node, and monitor filesystem integrity for unexpected file creation events.

Compensating Controls: Restrict permissions for creating or modifying workflows to trusted users only and implement strict network segmentation to limit the potential blast radius of a compromised automation server.

Public Exploit Available: No (exploit_available: false)

Given the potential for remote code execution, this vulnerability represents a significant threat to the security posture of the automation environment. Administrators must prioritize updating n8n to the patched versions specified above to prevent unauthorized filesystem access and maintain the integrity of automated processes.