What is the CVSS score of CVE-2026-21877?

CVE-2026-21877 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 12.5%.

Which versions of Node.js are affected by CVE-2026-21877?

Organizations using n8n face critical risk from CVE-2026-21877, a code injection vulnerability rated CVSS 9.9.. A patch is available.

Is there a public PoC exploit available for CVE-2026-21877?

Yes, a public proof-of-concept exploit is available for CVE-2026-21877. Prioritise patching immediately. EPSS: 12.5%.

How to fix or mitigate CVE-2026-21877?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Validate that input sanitization is in place for all user-controlled parameters.

Node.js CVE-2026-21877

CRITICAL

Code Injection (CWE-94)

2026-01-08 security-advisories@github.com

GHSA-v364-rw7m-3263

RCE Code Injection Node.js N8n

9.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

Patch released

Jan 20, 2026 - 15:08 nvd

Patch available

CVE Published

Jan 08, 2026 - 01:15 nvd

CRITICAL 9.9

DescriptionGitHub Advisory

n8n is an open source workflow automation platform. In versions 0.121.2 and below, an authenticated attacker may be able to execute malicious code using the n8n service. This could result in full compromise and can impact both self-hosted and n8n Cloud instances. This issue is fixed in version 1.121.3. Administrators can reduce exposure by disabling the Git node and limiting access for untrusted users, but upgrading to the latest version is recommended.

AnalysisAI

n8n workflow automation (through 1.121.2) allows authenticated users to execute arbitrary code via the n8n service, with scope change enabling full compromise of both self-hosted and cloud instances. EPSS 12.5% indicates high exploitation activity. Patch available.

Technical ContextAI

An authenticated user can exploit code injection (CWE-94) through the n8n workflow engine to execute arbitrary code on the server. The scope change means the attacker can access credentials and connections for all integrated services. This affects both self-hosted and n8n Cloud instances.

RemediationAI

Update to n8n 1.121.3 or later immediately. Disable the Git node if not needed. Restrict untrusted user access. Rotate all stored credentials if exploitation is suspected.