CVE-2026-77080: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in n8n-io n8n

The vulnerability in n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 involves improper neutralization of special elements used in OS commands within the Snowflake node. This node allows free-form Execute Query input, including client-side commands, to be passed directly to the Snowflake SDK without applying n8n's file-access restrictions. Consequently, an authenticated user with usable Snowflake credentials can upload local files from the n8n host or overwrite existing files with staged ones, leading to arbitrary file read and write capabilities.

An authenticated user with valid Snowflake credentials can exploit this vulnerability to read arbitrary files from the n8n host or overwrite files, potentially leading to unauthorized data access or modification. The vulnerability does not require user interaction and has a high impact on confidentiality, integrity, and availability as indicated by the CVSS 8.7 score.

A patch is available for this vulnerability. Users should upgrade n8n to versions 1.123.69 or later, 2.33.4 or later, or 2.34.1 or later to remediate this issue. Since n8n is a cloud service, the vendor typically manages remediation for hosted instances; users should verify with the vendor that their service is updated. No additional mitigation steps are indicated by the vendor advisory.