cve.threatint.com Remote Code Execution Vulnerability in n8n Git Node (CVE-2026-77084)
Article Content
- •CVE-2026-77084 affects n8n versions prior to 1.123.69 and 2.x before 2.33.4/2.34.1.
- •The vulnerability allows remote code execution via unneutralized git configuration values.
- •Patches are available, and users are urged to update and restrict repository access.
A remote code execution vulnerability (CVE-2026-77084) has been identified in n8n versions prior to 1.123.69 and 2.x before 2.33.4/2.34.1. The Git node in these versions executes certain repository-local git configuration values without proper neutralization, allowing an attacker to execute arbitrary code as the n8n process user. Exploitation requires a separate file-write vulnerability to insert malicious configuration values into the repository. Currently, there is no evidence of public proof-of-concept or active exploitation. Users are advised to update to the patched versions and restrict repository write access. The CVSS score for this vulnerability is 4.0, indicating a medium severity level. The vulnerability was published on August 20, 2026.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (7)
Following this threat?
Track CVE-2026-77084 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical RCE Vulnerability in Langflow Exposed CVE-2026-105740 is a critical remote code execution (RCE) vulnerability affecting Langflow versions prior to 1.9.0. Authenticated users can exploit this flaw by adding an MCP server with the 'Stdio' transport, allowing arbitrary OS commands to be executed without validation. The vulnerability was published on October…