In versions before 1.123.76, 2.37.7, and 2.38.2, the Git node validated a relative remote URL against the configured repositoryPath but then invoked… (CVE-2026-92587)
n8n is a workflow automation platform. In versions before 1.123.76, 2.37.7, and 2.38.2, the Git node validated a relative remote URL against the configured repositoryPath but then invoked git with that path as its working directory; git walked up to the enclosing repository's top level and resolved the same relative URL from there. An authenticated user (member) who nested the repository one level below the configured path could therefore make an identical URL string pass the file-access check while git resolved it outside the sandbox. A subsequent fetch or pull read a git repository outside N8N_RESTRICT_FILE_ACCESS_TO and merged its objects into the user's own repository, where their contents could be read back. The issue is fixed in n8n 1.123.76, 2.37.7, and 2.38.2, which resolve the remote reference from the directory git actually operates in before applying the sandbox check. As a workaround, the Git node can be disabled by adding n8n-nodes-base.git to NODES_EXCLUDE.
AI Analysis
Technical Summary
In n8n versions prior to 1.123.76, 2.37.7, and 2.38.2, the Git node validated relative remote URLs against the configured repositoryPath but then invoked git with that path as the working directory. Git resolved the relative URL from the enclosing repository's top level, allowing an authenticated user who nested the repository one level below the configured path to bypass the file-access check. This enabled reading git repositories outside the sandbox by merging external repository objects into the user's repository. The vulnerability is addressed by resolving the remote reference from the actual git working directory before applying sandbox checks. Disabling the Git node is a recommended workaround.
Potential Impact
An authenticated user with member privileges could read git repository contents outside the intended sandbox, potentially exposing sensitive data from repositories not meant to be accessible. The vulnerability does not allow code execution or denial of service but compromises confidentiality by unauthorized data access.
Mitigation Recommendations
The issue is fixed in n8n versions 1.123.76, 2.37.7, and 2.38.2. Users should upgrade to one of these versions to remediate the vulnerability. As a workaround, the Git node can be disabled by adding 'n8n-nodes-base.git' to the NODES_EXCLUDE configuration. No other mitigation steps are specified.
In versions before 1.123.76, 2.37.7, and 2.38.2, the Git node validated a relative remote URL against the configured repositoryPath but then invoked… (CVE-2026-92587)
Description
n8n is a workflow automation platform. In versions before 1.123.76, 2.37.7, and 2.38.2, the Git node validated a relative remote URL against the configured repositoryPath but then invoked git with that path as its working directory; git walked up to the enclosing repository's top level and resolved the same relative URL from there. An authenticated user (member) who nested the repository one level below the configured path could therefore make an identical URL string pass the file-access check while git resolved it outside the sandbox. A subsequent fetch or pull read a git repository outside N8N_RESTRICT_FILE_ACCESS_TO and merged its objects into the user's own repository, where their contents could be read back. The issue is fixed in n8n 1.123.76, 2.37.7, and 2.38.2, which resolve the remote reference from the directory git actually operates in before applying the sandbox check. As a workaround, the Git node can be disabled by adding n8n-nodes-base.git to NODES_EXCLUDE.
CVSS v3.1
Score 5.0medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In n8n versions prior to 1.123.76, 2.37.7, and 2.38.2, the Git node validated relative remote URLs against the configured repositoryPath but then invoked git with that path as the working directory. Git resolved the relative URL from the enclosing repository's top level, allowing an authenticated user who nested the repository one level below the configured path to bypass the file-access check. This enabled reading git repositories outside the sandbox by merging external repository objects into the user's repository. The vulnerability is addressed by resolving the remote reference from the actual git working directory before applying sandbox checks. Disabling the Git node is a recommended workaround.
Potential Impact
An authenticated user with member privileges could read git repository contents outside the intended sandbox, potentially exposing sensitive data from repositories not meant to be accessible. The vulnerability does not allow code execution or denial of service but compromises confidentiality by unauthorized data access.
Mitigation Recommendations
The issue is fixed in n8n versions 1.123.76, 2.37.7, and 2.38.2. Users should upgrade to one of these versions to remediate the vulnerability. As a workaround, the Git node can be disabled by adding 'n8n-nodes-base.git' to the NODES_EXCLUDE configuration. No other mitigation steps are specified.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-f9wr-qmqc-cpw3
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-92587"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aab494355bf5e2cf59903f5
Added to database: 09/17/2026, 01:58:27 UTC
Last enriched: 09/17/2026, 02:02:07 UTC
Last updated: 09/17/2026, 03:01:24 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.