n8n, an open source workflow platform, suffers from a critical flaw that allows an authenticated attacker to write arbitrary files to the server. By leveraging this, the attacker can place malicious code and trigger its execution, leading to full system compromise. The issue manifests in n8n versions 0.121.2 and earlier and is identified as both an arbitrary file write (CWE‑434) and a potential code injection (CWE‑94).

Affected systems include the n8n-io:n8n product, applicable to both self‑hosted deployments and the n8n Cloud offering. Any installation running the vulnerable 0.121.2 release or earlier is susceptible. The vulnerability was addressed in the 1.121.3 release, which removes the insecure file handling path.

The CVSS score of 10 reflects a complete compromise risk, and the current EPSS estimate of 11% indicates a moderate likelihood that attackers will target this flaw. The vulnerability is not yet listed in the CISA KEV catalog, but the combination of a high severity, a known exploitable code path, and the requirement for authenticated access suggests that strong mitigations such as immediate patching or disabling the Git node and limiting user privileges are necessary.