CVE-2026-25056: n8n Merge Node has Arbitrary File Write leading to RCE

February 4, 2026

A vulnerability in the Merge node’s SQL Query mode allowed authenticated users with permission to create or modify workflows to write arbitrary files to the n8n server’s filesystem potentially leading to remote code execution.

References

github.com/advisories/GHSA-hv53-3329-vmrm
github.com/n8n-io/n8n
github.com/n8n-io/n8n/security/advisories/GHSA-hv53-3329-vmrm
nvd.nist.gov/vuln/detail/CVE-2026-25056

Code Behaviors & Features

Detect and mitigate CVE-2026-25056 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →