n8n authenticated remote code execution in Git node

Executive brief

n8n is a popular workflow automation tool used to connect various business services. A vulnerability in its Git integration allows authenticated users with workflow creation permissions to execute unauthorized commands on the underlying server. This could lead to a full system takeover, data theft, or disruption of automated business operations.

Technical details

An OS command injection vulnerability (CWE-78) exists in the n8n Git node. Authenticated users with permissions to create and execute workflows can exploit default Git security settings by staging a crafted local repository. This causes Git to execute arbitrary hooks as the n8n process user. The attack requires network access to an authenticated n8n session but no further special privileges beyond standard workflow creation rights. The issue is resolved in versions 1.123.67, 2.31.5, and 2.32.1.

Affected products

• n8n-io n8n < 1.123.67, >= 2.0.0-rc.0 < 2.31.5, >= 2.32.0 < 2.32.1

Timeline

• 2026-07-22: disclosed
• 2026-07-22: advisory
• 2026-07-22: patched

References

• https://api.github.com/users/simonkoeck
• https://github.com/simonkoeck
• https://api.github.com/users/simonkoeck/gists%7B/gist_id%7D
• https://api.github.com/users/simonkoeck/repos
• https://avatars.githubusercontent.com/u/54739715?v=4
• https://api.github.com/users/simonkoeck/events%7B/privacy%7D