Week 45, updated 2 Nov 2026

Automation & agent frameworks n8n

Is n8n safe?

Short answer: Caution. StackGrade's weekly scan of n8n-io/n8n gives it a Caution label for 3 critical-severity known vulnerabilities in runtime dependencies (OSV). It does list 46 high-severity advisories in runtime dependencies, which don't change the label. 3 phrases in agent instruction files were flagged for human review (unclear). Critical advisories are counted once per package; a known issue in a locked package version does not prove n8n is exploitable in your setup. Automated scan of commit 42cbbf7 on 2 Nov 2026, not a manual audit.

Updated : the last week its score, rank or safety result changed.

Fair-code workflow automation platform with native AI, 400+ integrations, self-host or cloud.

  • 209,320 stars
  • pushed 2 Nov
  • Sustainable Use License
  • TypeScript

github.com/n8n-io/n8n · n8n.io

70score out of 100

#3of 52 overall#1in Automation & agent frameworks▼ 2 vs Week 44

  • Maintenance 30%81
  • Adoption 30%96
  • Docs 20%16
  • Community 20%–
W42W43W44W45

Score over the last 4 weeks: 69, 72, 72, 70.

Caution

3 critical-severity known vulnerabilities in runtime dependencies (OSV).

How this score works

Each part is a percentile among all 52 tracked tools, so 50 is average for this list. Community is not measured yet; the score uses the other 80%.

  • Maintenance: Last push 2 Nov 2026. Last 10 GitHub releases within 2 days (about 133 per 30 days), latest release 30 Oct 2026. Issue close time: fewer than 5 closed issues, so not used.
  • Adoption: 209,320 stars (70%), 61,352 forks (30%).
  • Docs: README 3,980 characters, 9 headings, 2 code blocks, install section: yes.

Methodology

#1 of 14 in Automation & agent frameworks

Ranked by score. The yellow row is this tool.

Automation & agent frameworks, Week 45score 0–100, safety
  1. 1n8n#3 overall70Caution
  2. 2AutoGPT#14 overall62Caution
  3. 3CrewAI#18 overall57Caution
  4. 4Dify#20 overall56Caution
  5. 5LangChain#23 overall54Caution
  6. 6Pydantic AI#31 overall46Caution
Show the other 8
  1. 7Mastra#33 overall44No issues found
  2. 8LangGraph#34 overall44No issues found
  3. 9Agent Development Kit (ADK, Python)#36 overall43Caution
  4. 10OpenBot#39 overall41Caution
  5. 11AutoGen#41 overall40Caution
  6. 12OpenAI Agents SDK (Python)#42 overall39Caution
  7. 13smolagents#47 overall30No dependencies scanned
  8. 14artemis#50 overall25Caution

Safety scan, 2 Nov 2026

Automated scan of commit 42cbbf7, 29,497 files. Not a manual audit.

Caution

  • 3Critical dependency advisories46 high, 55 medium, 15 low. OSV, runtime dependencies only.
  • 1Install hooksnpm scripts that run on install; none downloads remote content.
  • 0Remote-code patternsFor example eval(fetch(…)).
  • 2528Agent files checked3 phrases flagged for review.
  • 4curl | sh installersIn docs or program code. Information only.
Why this label?

Why this label:

  • 3 critical-severity known vulnerabilities in runtime dependencies (OSV)

Known vulnerabilities in runtime dependencies (OSV): 3 critical, 46 high, 55 medium, 15 low

  • aiohttp@3.12.15 (PYSEC-2026-2102) in packages/@n8n/task-runner-python/uv.lock
  • @storybook/addon-vitest@10.5.10 (GHSA-f2ph-cmg5-wxc8) in pnpm-lock.yaml
  • storybook@10.5.10 (GHSA-f2ph-cmg5-wxc8) in pnpm-lock.yaml

Also found (informational, does not change the label):

  • 3 injection-related phrases in instruction files, flagged for human review (often defensive guidance), e.g. packages/@n8n/instance-ai/skills/agent-builder/SKILL.md
  • 46 high-severity known vulnerabilities in runtime dependencies (OSV)
  • 1 npm install hook, none downloading remote content
  • Program code runs a curl|sh style installer (2 occurrences, e.g. .githooks/check-pnpm.mjs)
  • Documents curl|sh style installer (2 occurrences, e.g. README.md)
  • Skill scripts contact: localhost, cdn.jsdelivr.net, guidelines.n8n.design, api.smith.langchain.com, 127.0.0.1, telemetry.n8n.io, datasets-server.huggingface.co, api.openai.com

Notes:

  • 7 affected packages only in dev/test/docs manifests, not counted
  • Telemetry/analytics references in code: posthog, telemetry, sentry_sdk, segment.io, segment.com

Automated scan of commit 42cbbf7 on 2 Nov 2026, not a manual audit. 29,497 files checked. What we check

Repo activity

From the GitHub API, fetched 2 Nov 2026.

  • 10+Releases, 90 daysLatest n8n@1.123.91, 30 Oct
  • –Median issue closeFewer than 5 closed issues
  • 209kStars+708 since 26 Oct
  • 61.4kForks1,197 open issues
  • 2019Repo created22 Jun 2019
30 days ago2 Nov
10 releases in the last 30 days, one mark each (GitHub releases feed, last 10 entries).

10 releases in the last 30 days (GitHub releases feed, last 10 entries):

Questions about n8n

Answers use this week's StackGrade data.

Is n8n safe to use?

Caution. StackGrade's weekly scan of n8n-io/n8n gives it a Caution label for 3 critical-severity known vulnerabilities in runtime dependencies (OSV). It does list 46 high-severity advisories in runtime dependencies, which don't change the label. 3 phrases in agent instruction files were flagged for human review (unclear). Critical advisories are counted once per package; a known issue in a locked package version does not prove n8n is exploitable in your setup. Automated scan of commit 42cbbf7 on 2 Nov 2026, not a manual audit.

How does StackGrade score n8n?

n8n scores 70 out of 100 in Week 45: #3 of 52 tracked tools overall and #1 in Automation & agent frameworks. The score combines maintenance (81), adoption (96) and docs (16) as percentiles among all 52 tracked tools; community (20% weight) is not measured yet, so the score uses the other 80%. It is not a hands-on test and it is separate from the safety label.

What are the alternatives to n8n?

The highest-scored other tools in Automation & agent frameworks this week: AutoGPT (62, Caution), CrewAI (57, Caution), Dify (56, Caution), LangChain (54, Caution). StackGrade has not tested them hands-on.

What licence does n8n use?

The licence listed for n8n-io/n8n is Sustainable Use License. Read the licence text before commercial use.

Compare and use it

All facts and sources
Type
AI tool
License
Sustainable Use License
Language
TypeScript
Created
22 Jun 2019
Owner
n8n-io (Organization)
Forks
61,352
Homepage
n8n.io

GitHub description: “Fair-code workflow automation platform with native AI capabilities. Combine visual building with custom code, self-host or cloud, 400+ integrations.”

Sources: github.com/n8n-io/n8n, api.github.com/repos/n8n-io/n8n, raw.githubusercontent.com/n8n-io/n8n/master/README.md. Fetched 2 Nov 2026.

Know when n8n changes label

One email a week: the new top 10, the biggest score changes and every safety label that changed.

Free. Double opt-in: you confirm by email first, unsubscribe in one click.