CVE-2026-110845
7.7HighPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-15
Impact
Authenticated users can execute arbitrary commands as the n8n process user. They need valid credentials to configure a Git node (or supply it as an agent tool) pointing to a repository whose local configuration they control.
Root cause
The Git node Log operation invokes an external program without stripping local repository git configuration settings.
Affected systems
n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade n8n to 1.123.83, 2.41.4, 2.42.1, or later. If upgrading immediately is not possible, restrict user permissions to configure workflows using the Git node or block access to untrusted repositories.
$ npm update -g n8nAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a code execution vulnerability in the Git node Log operation, which fails to strip a repository's local git configuration before invoking an external program. Authenticated members who can point the node, including as an agent tool, at a repository whose local configuration they control can execute programs as the n8n process user.