The Execute Command node in n8n permits any authenticated user to launch operating‑system commands on the machine that hosts the workflow engine. This allows an attacker who has valid user credentials—or has compromised a user account—to run arbitrary code with the same privileges as n8n’s execution process. The result can be data theft, disruption of services, or complete take‑over of the underlying host, representing a classic example of broken access control (CWE‑284).

The vulnerability affects the n8n workflow automation platform. Every installation that makes the Execute Command node available to authenticated users is subject to this flaw. Because no specific release numbers are identified in the advisory, all current and older versions of n8n remain at risk until a patch is applied or the node is removed from use.

With a CVSS score of 8.7 the flaw is classified as high severity. Exploitation requires only authenticated access; elevated privileges or prior system compromise are not prerequisites. The EPSS value of less than 1% suggests that, while the probability of a successful exploit in the wild is low, the remote code execution nature keeps it a significant threat. The vulnerability is not listed in CISA’s KEV catalog, meaning no public exploit has been identified to date.