Executive brief
n8n is a workflow automation platform that allows users to create and execute workflows combining various integrations. The Git node in n8n can be exploited by authenticated users to execute arbitrary commands on the hosting system with the privileges of the n8n process, allowing attackers to compromise the entire n8n instance and any systems it connects to.
Technical details
The vulnerability is a code execution flaw (CWE-78: Improper Neutralization of Special Elements used in an OS Command) in the n8n Git node. Authenticated users with workflow creation and execution permissions can exploit insecure git security settings to stage a crafted local repository containing git hooks. When the Git node processes this repository, git executes these hooks with the privileges of the n8n process user, allowing arbitrary command execution. The attack requires network access to an n8n instance and valid user credentials but no additional user interaction. Patches are available in versions 1.123.67, 2.31.5, and 2.32.1 and later.
Affected products
- n8n n8n < 1.123.67, 2.0.0-rc.0 to < 2.31.5, 2.32.0 to < 2.32.1
Timeline
- 2026-07-22: disclosed: GHSA-rcv6-pvrj-4xcg published
- 2026-07-22: patched: Patches released in versions 1.123.67, 2.31.5, and 2.32.1