RCE risk with Execute Command in n8n
- Feb 12
- 1 min read
What this means (non-technical)
The Execute Command node runs shell commands directly on the server where n8n is hosted. This gives the workflow direct access to the system.
If any part of the command includes user input, that input could potentially change what the server runs.
What usually goes wrong
If user-provided data is inserted into a shell command without strict control, someone could add extra commands.
Because the command runs on your server, it may have access to files, databases, and network resources.
This can lead to:
Reading sensitive files.
Modifying system configuration.
Sending internal data elsewhere.
Even without malicious intent, a small mistake in command construction can cause serious damage.
When this becomes urgent
This becomes critical when:
The command includes data from webhooks or forms.
The server hosts other important services.
Multiple users can edit workflows.
The instance is exposed to the internet.
The combination of public input and system-level commands is especially risky.
Detect issues in your n8n workflows
|
Definitions
Shell command: A command executed directly by the server’s operating system.
Remote Code Execution (RCE): When someone can cause your server to run commands they control.
Disclaimer
This article highlights common patterns and risks seen in real-world n8n workflows. It’s meant to help you build more confidently and avoid surprises as your automation grows. Behavior can vary depending on your setup, version, and configuration.