CVE-2025-71380

n8n - Arbitrary Command Execution via Execute Command Node

CVSS 8.7 HIGHCWE-284

Vexday Risk Score

18Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 8.7EPSS —KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Lifecycle

04 Jul 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

The Execute Command node in n8n allows authenticated users to execute arbitrary commands on the host system where n8n runs. Attackers with user access or compromised credentials can exploit this node to run malicious commands, potentially leading to data exfiltration, service disruption, or complete system compromise.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected products

n8n · n8n

References

https://github.com/n8n-io/n8n/security/advisories/GHSA-365g-vjw2-grx8 https://www.vulncheck.com/advisories/n8n-arbitrary-command-execution-via-execute-command-node