The vulnerability allows an authenticated user who can create or edit workflows to write to specific configuration files via the Read/Write Files from Disk node. By subsequently triggering a git operation, the attacker can execute arbitrary shell commands on the n8n host. This flaw represents a classic command injection weakness, categorized as CWE‑94, and can compromise the confidentiality, integrity, and availability of the entire system.

The affected product is n8n by n8n‑io. All releases before 2.2.0 and before 1.123.8 are vulnerable. Users are advised to upgrade to version 2.2.0 or 1.123.8 or any later release to remove the flaw.

With a CVSS score of 9 the vulnerability is considered critical. The EPSS score is less than 1%, indicating a low probability of exploitation, and the flaw is not listed in the CISA KEV catalog. Exploitation requires that the attacker has authenticated access and the permission to create or modify workflows. The attack path involves writing to a configuration file and then initiating a git operation, which can invoke arbitrary shell commands on the host. The impact is full remote code execution on the affected node.