n8n CVE-2026-118646

Requires an authenticated n8n user with member-level privileges who can create and execute workflows (PR:L confirms authentication is needed). The workflow must use the Read/Write Files from Disk node (n8n-nodes-base.readWriteFile), and the attacker must supply a wildcard-heavy File(s) Selector glob pattern that compiles to a catastrophically backtracking regular expression. Exploitation is limited by: the need for valid authenticated access with workflow create/run rights; the Read/Write Files node being enabled (it can be disabled via the NODES_EXCLUDE environment variable, which the vendor lists as a temporary mitigation); and the impact being limited to denial of service until process restart, with no data disclosure or modification.

This is a genuine but bounded availability risk, not a top-tier emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) shows a network-reachable, low-complexity attack requiring low privileges (PR:L) and no user interaction, with impact confined entirely to availability of the vulnerable system (VA:H; VC:N/VI:N - no confidentiality or integrity impact and no scope/subsequent-system effect). The vuln.today decision label is 'this_week', consistent with a high-impact DoS that is gated behind authentication rather than a drop-everything scenario. No EPSS score, no CISA KEV listing, and no confirmed public exploit code were provided; the only external references are the n8n GHSA advisory and a VulnCheck advisory, both of which are vendor/coordinator write-ups rather than working exploits. The key limiting signal - PR:L plus the need to create and run a workflow using a specific node - means exploitation is restricted to users who already have authenticated, workflow-authoring access to the instance, which substantially narrows the realistic threat to insiders or attackers who have already obtained member credentials. No data here is directly conflicting; the main gap is the absence of EPSS and KEV data, so probability of mass exploitation cannot be quantified from the inputs.

An authenticated n8n member with permission to build and execute workflows creates a workflow containing a Read/Write Files from Disk node and sets the File(s) Selector to a wildcard-heavy glob pattern. When the workflow runs, the pattern compiles to a regular expression that triggers exponential backtracking on the main event loop, freezing the entire n8n process so the UI, API, webhooks, and health checks stop responding until an administrator restarts it. No public working exploit code is identified in the provided data, though vendor and coordinator advisories describing the issue exist.