What is the CVSS score of CVE-2026-21893?

CVE-2026-21893 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of N8n are affected by CVE-2026-21893?

n8n workflow automation instances running versions 0.187.0 through 1.120.2 are vulnerable to command injection attacks through the package installation feature, potentially allowing attackers to…. A patch is available.

How to fix or mitigate CVE-2026-21893?

Within 24 hours: Inventory all n8n deployments and identify systems running affected versions (0.187.0-1.120.2). Within 7 days: Apply patch to version 1.120.3 or later across all instances; if immediate patching is impossible, restrict package installation functionality to administrators only and disable community package sources. Within 30 days: Conduct post-patch verification testing and review audit logs for suspicious package installation activity during the exposure window.

N8n CVE-2026-21893

HIGH

Improper Input Validation (CWE-20)

2026-02-04 security-advisories@github.com

GHSA-7c4h-vh2m-743m

Command Injection N8n

7.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

Patch released

Feb 20, 2026 - 17:07 nvd

Patch available

CVE Published

Feb 04, 2026 - 18:16 nvd

HIGH 7.2

DescriptionGitHub Advisory

n8n is an open source workflow automation platform. From version 0.187.0 to before 1.120.3, a command injection vulnerability was identified in n8n’s community package installation functionality. The issue allowed authenticated users with administrative permissions to execute arbitrary system commands on the n8n host under specific conditions. This issue has been patched in version 1.120.3.

AnalysisAI

n8n versions 0.187.0 through 1.120.2 contain a command injection vulnerability in the community package installation feature that allows authenticated administrators to execute arbitrary system commands on the host. The vulnerability requires high privilege access and specific conditions to exploit but carries high risk due to potential complete system compromise. A patch is available in version 1.120.3.

Technical ContextAI

Classified as CWE-20 (Improper Input Validation). Affects N8N. n8n is an open source workflow automation platform. From version 0.187.0 to before 1.120.3, a command injection vulnerability was identified in n8n’s community package installation functionality. The issue allowed authenticated users with administrative permissions to execute arbitrary system commands on the n8n host under specific conditions. This issue has been patched in version 1.120.3.