CVE-2026-85168: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in n8n-io n8n
Description
n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in the Git node. This flaw arises because certain configuration keys related to content-filter and merge-driver were not properly reset, allowing git to execute attacker-controlled commands during common operations. The commands run with the privileges of the n8n process user.
CVSS v4.0
Score 7.7high
Affected software
n8n-io
n8n
n8n-io
n8n
n8n-io
n8n
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-85168 is an OS command injection vulnerability in the n8n Git node affecting versions prior to 1.123.73, 2.35.4, and 2.36.2. The node resets a fixed list of command-bearing configuration keys before each operation, but this list omitted keys in the content-filter and merge-driver families. If a repository has local configuration settings using these keys with matching attribute patterns, git executes the configured commands during Add, Commit, Checkout, or Pull operations. The commands execute with the permissions of the n8n process user, enabling remote code execution.
Potential Impact
An attacker controlling a repository with crafted local configuration can cause arbitrary commands to be executed on the n8n host with the privileges of the n8n process user. This can lead to remote code execution, potentially compromising the system running n8n.
Mitigation Recommendations
Fixed versions 1.123.73, 2.35.4, and 2.36.2 are available that address this vulnerability by properly resetting all relevant configuration keys. Users should upgrade to one of these versions or later to remediate the issue. No vendor advisory content is provided, but the presence of fixed versions indicates an official fix is available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-03T11:05:09.078Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a995c08acd9273b49dbb6a9
Added to database: 09/03/2026, 11:37:44 UTC
Last enriched: 09/17/2026, 02:02:38 UTC
Last updated: 10/17/2026, 06:48:21 UTC
Views: 43
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.