This vulnerability in n8n's Git node involves improper neutralization of special elements used in OS commands, leading to potential code execution. Specifically, repository-local git configuration values are executed without sanitization, which can be exploited if an attacker can first write a malicious value into the repository via another vulnerability. The flaw affects versions prior to 1.123.69 in the 1.x branch and versions before 2.33.4 and 2.34.1 in the 2.x branch. The vulnerability has a CVSS 4.0 score of 7.7, indicating high severity, with network attack vector, low attack complexity, and partial privileges required.

Successful exploitation allows an attacker to execute arbitrary code as the n8n process user by leveraging malicious git configuration values. However, exploitation requires a prior file-write vulnerability to plant the malicious configuration, limiting direct exploitation through the Git node alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor vendor communications for updates. Mitigation may involve restricting file-write permissions to prevent planting malicious git configuration values and limiting the privileges of the n8n process user to reduce impact.