top of page

Unsafe module import in n8n

  • Feb 12
  • 1 min read

What this means (non-technical)


In some setups, Code nodes may allow loading additional modules, depending on how the environment is configured.


Some modules allow file system access, command execution, or network control. When these are imported inside workflows, they run with the same permissions as your n8n server.

What usually goes wrong


If unsafe modules are used:


  • Code can read or modify server files.

  • External connections can be opened.

  • System commands can be executed.


This increases the impact of any mistake or malicious code inside a workflow.


Even importing modules dynamically (based on user input) can create unpredictable behavior.


Over time, this blurs the line between workflow logic and server-level control.

When this becomes urgent


This becomes urgent when:


  • Multiple users can create or edit Code nodes.

  • Workflows are imported from third parties.

  • The server has access to sensitive systems.

  • The instance runs in production.


The more powerful the imported modules, the more carefully they should be controlled.

Detect issues in your n8n workflows

Upload your JSON to detect if any issue is present in your workflow

Definitions


  1. Module import: Loading external code libraries into a script.


  2. File system access: The ability to read or write files on the server.

Disclaimer


This article highlights common patterns and risks seen in real-world n8n workflows. It’s meant to help you build more confidently and avoid surprises as your automation grows. Behavior can vary depending on your setup, version, and configuration.

Related Posts

See All
Unencrypted FTP in n8n

What this means (non-technical) Plain FTP sends usernames, passwords, and file contents over the network without encryption. If you use FTP instead of SFTP or FTPS, your data travels in readable form.

 
 
Sensitive pinned data in n8n

What this means (non-technical) Pinned data saves a previous execution’s output so you can test downstream nodes without re-running the whole workflow. If that pinned data includes API responses, data

 
 
Permissive CORS in n8n

What this means (non-technical) CORS controls which websites are allowed to make requests to your n8n instance from a browser. If CORS is set to allow all origins (often shown as *), any website can s

 
 
bottom of page