An OS command injection vulnerability in n8n allows authenticated attackers to execute arbitrary code on the server, posing a critical threat to system security.

This vulnerability is an OS command injection flaw (CWE-78) where input is not properly neutralized before being passed to system-level commands. An authenticated attacker can leverage this to gain unauthorized control over the server environment.

Successful exploitation allows an attacker to execute arbitrary commands with the privileges of the n8n application process, leading to full system compromise. The CVSS score of 8.7 highlights the extreme danger this poses to the confidentiality, integrity, and availability of the host system.

Immediate Action: Update n8n to version 1.123.69, 2.34.1, or 2.33.4, depending on the current branch in use.

Proactive Monitoring: Monitor for unauthorized process execution, unusual system calls, or suspicious network connections originating from the n8n service account.

Compensating Controls: Use strict process isolation and least-privilege configurations for the n8n container or service to limit the potential blast radius of a successful injection.

Public Exploit Available: Unknown.

Given the potential for complete system takeover, applying the vendor-provided security updates is mandatory. Organizations must verify their current version and move to the patched releases immediately to eliminate the risk of remote command execution.