n8n, an open-source workflow automation platform, contains a command-injection flaw in its community package installation routine. The vulnerability allows an attacker who can authenticate with administrative privileges to run arbitrary system commands on the host machine. This flaw could be exploited by sending a specially crafted package name to the installation endpoint, resulting in full compromise of confidentiality, integrity, and availability of the server.

Vulnerable versions range from 0.187.0 up to, but not including, 1.120.3. The flaw exists only when the community package installation feature is enabled and users possessing administrative permissions are able to submit package names. Any deployment of the affected n8n version that meets these conditions is therefore at risk.

The base CVSS score of 9.4 labels this issue as critical. The EPSS score of 1.3% (0.01343) indicates a very low but nonzero probability of automated exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Attackers need only an authenticated administrative account to inject a malicious command; once they have that, they can execute arbitrary commands on the host. Because the command is passed directly to the operating-system shell, the influence of the vulnerability is immediate and comprehensive.