CVE-2026-21893 | n8n-io n8n up to 1.120.2 Community Package Installation os command injection (GHSA-7c4h-vh2m-743m)

A vulnerability marked as critical has been reported in n8n-io n8n up to 1.120.2. The affected element is an unknown function of the component Community Package Installation Handler. This manipulation causes os command injection.

This vulnerability appears as CVE-2026-21893. The attack may be initiated remotely. There is no available exploit.

It is suggested to upgrade the affected component.