CVE-2026-85168

n8n before 1.123.73 Remote Code Execution via Git Node

State: Published
Severity: 7.7 High
Published: Sep 3, 2026
Updated: Oct 29, 2026
Reserved: Sep 3, 2026

Description

n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in the Git node. The node reset a fixed list of command-bearing configuration keys before each operation, but that list did not cover the content-filter and merge-driver key families. A repository with local configuration setting one of those keys together with a matching attribute pattern causes git to execute the configured command during an ordinary Add, Commit, Checkout, or Pull operation. The command runs as the n8n process user.

Scores

CVSS	Score	Vector	Source
4.0	7.7 High	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	VulnCheck

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

Product	Versions
n8nn8n-io	before 1.123.73Affected 1.123.73Not affected
n8nn8n-io	2.36.0 to before 2.36.2Affected 2.36.2Not affected
n8nn8n-io	2.0.0-rc.0 to before 2.35.4Affected 2.35.4Not affected

References

GitHub Security Advisory (GHSA-mwp5-2m32-r54h)vendor-advisory
VulnCheck Advisory: n8n before 1.123.73 Remote Code Execution via Git Nodethird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.