Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
n8n Git node executes repository-local git configuration values without proper neutralization. Any subsequent Git node operation against a repository containing a malicious configuration value will execute it as the n8n process user. Exploitation requires a separate file-write vulnerability to plant the malicious value in the repository.
An attacker who can write files to a git repository (via a separate vulnerability) can execute arbitrary code as the n8n process user when any Git node operation is performed against that repository.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Yes. Patch available for n8n versions 1.123.69, 2.33.4, and 2.34.1 or later.
Update n8n to version 1.123.69 or later (for 1.x branch) or 2.33.4 / 2.34.1 or later (for 2.x branch). Additionally, restrict repository write access and audit any repositories used with Git nodes for malicious git configuration values.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Feedly found the first article mentioning CVE-2026-77084 . See article
NVD published the first details for CVE-2026-77084
A CVSS base score of 7.7 has been assigned.
GitHub Advisories released a security advisory .
n8n before 1.123.69 Remote Code Execution via Git Node Configuration Valuesn8...
CVE-2026-77084 | n8n-io n8n prior 1.123.69/2.33.4/2.34.1 Git node os command injection
Collect, analyze, and vulnerability reports faster using AI
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
