Skip to content
n8n before 1.123.69 Remote Code Execution via Git Node Configuration Valuesn8... CVE: New / 6h The Git node executed certain repository-local git configuration values without neutralizing them, so any subsequent Git node operation against a repository containing a malicious value would execute it as the n8n process user. This is not reachable through the Git node's own configuration controls and requires a separate file-write vulnerability elsewhere to plant the malicious value.

n8n before 1.123.69 Remote Code Execution via Git Node Configuration Valuesn8... CVE: New / 6h The Git node executed certain repository-local git configuration values without neutralizing them, so any subsequent Git node operation against a repository containing a malicious value would execute it as the n8n process user. This is not reachable through the Git node's own configuration controls and requires a separate file-write vulnerability elsewhere to plant the malicious value.

cve.threatint.com • August 20, 2026

n8n before 1.123.69 (and 2.x before 2.33.4 / 2.34.1) contains a code execution vulnerability in the Git node. The Git node executed certain repository-local git configuration values without neutralizing them, so any subsequent Git node operation against a repository containing a malicious value would execute it as the n8n process user. This is not reachable through the Git node's own configuration controls and requires a separate file-write vulnerability elsewhere to plant the malicious value.

PUBLISHED Reserved 2026-08-20 | Published 2026-08-20 | Updated 2026-08-20 | Assigner VulnCheck

HIGH: 7.7 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Problem types Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Product status Default status unaffected Any version before 1.123.69 affected 1.123.69 (semver) unaffected Default status unaffected Any version before 2.34.1 affected 2.34.1 (semver) unaffected Default status unaffected Any version before 2.33.4 affected 2.33.4 (semver) unaffected References github.com/...io/n8n/security/advisories/GHSA-m87g-qr43-ccvc (GitHub Security Advisory (GHSA-m87g-qr43-ccvc)) vendor-advisory (VulnCheck Advisory: n8n before 1.123.69 Remote Code Execution via Git Node Configuration Values) third-party-advisory cve.org (CVE-2026-77084) nvd.nist.gov (CVE-2026-77084) Download JSON

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

github.com/...io/n8n/security/advisories/GHSA-m87g-qr43-ccvc (GitHub Security Advisory (GHSA-m87g-qr43-ccvc)) vendor-advisory

(VulnCheck Advisory: n8n before 1.123.69 Remote Code Execution via Git Node Configuration Values) third-party-advisory

cve.org (CVE-2026-77084)

nvd.nist.gov (CVE-2026-77084)

Extracted Entities

Attack Types (1)

Zero-day Exploit

Tools (1)

Git