Executive brief
n8n is a low-code automation platform that allows users to create workflows connecting various applications and services. The Git node enables workflows to interact with Git repositories. This vulnerability allows authenticated users who can create or modify workflows to execute arbitrary system commands on the n8n server, potentially exposing sensitive files and compromising the entire deployment.
Technical details
The Git node in n8n contains an OS command injection vulnerability (CWE-78) that allows authenticated users with workflow creation or modification permissions to execute arbitrary system commands. The vulnerability is exploitable via the network without any special attack requirements or user interaction. An attacker can leverage this to read arbitrary files from the n8n host or execute malicious commands with the privileges of the n8n process. Patches are available in n8n versions 2.5.0 and 1.123.10; users on versions prior to these should upgrade immediately. Temporary workarounds include restricting workflow permissions to trusted users and disabling the Git node if not required.
Affected products
- n8n n8n before 1.123.10 and before 2.5.0
Timeline
- 2026-02-04: disclosed: Vulnerability published in GitHub Advisory Database
- 2026-02-04: patched: Fixed in n8n versions 2.5.0 and 1.123.10