Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.4

n8n workflow tool may allow unauthorized code execution

CVE-2026-44790 · published 4 days ago
Summary

The n8n automation software could let an attacker run its own code on your system. This risk has been fixed in newer releases, so update n8n to the latest version as soon as possible.

What to do
  • Update GitHub Actions n8n to version 2.19.3-aikido.4.
  • Update GitHub Actions n8n to version 1.123.43.
  • Update GitHub Actions n8n to version 2.22.1.
  • Update GitHub Actions n8n to version 2.20.7.
  • Update GitHub Actions n8n to version 2.19.3-aikido.3.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.3.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.4.
  • Update GitHub Actions n8n to version 2.19.3-aikido.5.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.5.
  • Update GitHub Actions n8n to version 2.19.3-aikido.6.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.6.
  • Update n8n to version 2.19.3-aikido.9.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.9.
  • Update n8n to version 2.19.3-aikido.10.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.10.
  • Update n8n to version 2.19.3-aikido.11.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.11.
  • Update n8n to version 2.19.3-aikido.13.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.13.
  • Update n8n to version 2.19.3-aikido.14.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.14.
  • Update n8n to version 2.19.3-aikido.15.
  • Update rootio @rootio/n8n to version 2.19.3-root.io.15.
Affected software
Ecosystem VendorProductAffected versions
Root:npm GitHub Actions n8n < 2.19.3-aikido.4
< 2.19.3-aikido.3
< 2.19.3-aikido.5
< 2.19.3-aikido.6
Fix: upgrade to 2.19.3-aikido.4
npm GitHub Actions n8n < 1.123.43
>= 2.21.0, < 2.22.1
>= 2.0.0-rc.0, < 2.20.7
Fix: upgrade to 1.123.43
– n8n n8n < 1.123.43
>= 2.0.0, < 2.20.7
>= 2.21.0, < 2.22.1
cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*
Root:npm rootio @rootio/n8n < 2.19.3-root.io.3
< 2.19.3-root.io.4
< 2.19.3-root.io.5
< 2.19.3-root.io.6
< 2.19.3-root.io.9
< 2.19.3-root.io.10
< 2.19.3-root.io.11
< 2.19.3-root.io.13
< 2.19.3-root.io.14
< 2.19.3-root.io.15
Fix: upgrade to 2.19.3-root.io.3
Root:npm – n8n < 2.19.3-aikido.9
< 2.19.3-aikido.10
< 2.19.3-aikido.11
< 2.19.3-aikido.13
< 2.19.3-aikido.14
< 2.19.3-aikido.15
Fix: upgrade to 2.19.3-aikido.9
Original advisory text
CVE-2026-44790 in n8n - Patched by Root
Root has patched CVE-2026-44790 in the n8n package for Root:npm. Multiple fixed versions available.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.4 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Timeline
Published6 Oct 2026
Updated9 Oct 2026
First seen14 May 2026
Sources
GHSA-57g9-58c2-xjg3 · GHSA
CVE-2026-44790 · NVD
ROOT-APP-NPM-CVE-2026-44790 · OSV
Track software like this
Free during beta