Executive brief
n8n is a workflow automation platform that allows users to create and modify automated processes. An authenticated attacker with workflow creation permissions can inject commands into the Git node's Push operation to read arbitrary files from the server, potentially exposing sensitive configuration data, credentials, or other confidential information and gaining full control over the system.
Technical details
This vulnerability is an argument injection flaw (CWE-88) in the Git node's Push operation handler. An authenticated user can craft malicious workflow configurations that inject arbitrary CLI flags into the Git command execution, allowing them to read arbitrary files from the filesystem and potentially execute arbitrary commands with the privileges of the n8n process. The attack requires authentication and workflow creation/modification permissions, but no user interaction. The vulnerability affects all n8n versions prior to 1.123.43, 2.20.7, or 2.22.1. Patches are available across the affected version branches.
Affected products
- n8n n8n < 1.123.43, < 2.20.7, < 2.22.1
Timeline
- 2026-05-14: disclosed: GHSA-57g9-58c2-xjg3 published on GitHub
- 2026-05-14: patched: Patches released in versions 1.123.43, 2.20.7, and 2.22.1