CVE-2025-71380 n8n CVE debrief

Who should care

Users of the n8n workflow automation tool should be aware of this vulnerability and take immediate action to mitigate it. Specifically, administrators of n8n instances should review user access and permissions, and ensure that the Execute Command node is properly configured and monitored. Additionally, security teams should prioritize patching or mitigating this vulnerability to prevent potential exploitation.

Technical summary

The Execute Command node in n8n allows authenticated users to execute arbitrary commands on the host system where n8n runs. This vulnerability is due to insufficient input validation and sanitization in the Execute Command node. Attackers can exploit this vulnerability by providing malicious input to the node, potentially leading to data exfiltration, service disruption, or complete system compromise. The vulnerability has a CVSS score of 8.7 and is considered high severity.

Defensive priority

High priority should be given to patching or mitigating this vulnerability. Administrators should review user access and permissions, and ensure that the Execute Command node is properly configured and monitored.

Recommended defensive actions

• Review and limit user access to the Execute Command node
• Ensure proper input validation and sanitization for the Execute Command node
• Monitor n8n instance logs for suspicious activity
• Apply patches or updates to the n8n workflow automation tool
• Consider implementing additional security controls, such as command whitelisting or restrictive access controls

Evidence notes

The CVE record was published on July 4, 2026, and the vulnerability has a CVSS score of 8.7. The Execute Command node in n8n allows authenticated users to execute arbitrary commands on the host system where n8n runs. The vulnerability is due to insufficient input validation and sanitization in the Execute Command node.

Official resources