n8n: Authenticated code execution in the n8n Git node
Authenticated users of n8n with workflow creation and execution rights can achieve code execution on the host via the Git node. This occurs when the Git node, under default security settings, processes a crafted local repository that triggers git hooks to run arbitrary commands as the n8n process user. Both self-hosted and cloud instances are affected if these conditions are met. The vulnerability is fixed in n8n versions 1.123.67, 2.31.5, and 2.32.1 and later. Temporary mitigations include restricting access to trusted users, disabling the Git node, and limiting network egress. These mitigations do not fully resolve the risk and upgrading is recommended.
AI Analysis
Technical Summary
This vulnerability in n8n's Git node allows authenticated users with workflow creation and execution permissions to execute arbitrary code on the host system. The issue arises because the Git node, using default git security settings, can be manipulated via a crafted local repository to cause git hooks to execute commands as the n8n process user. The vulnerability affects both self-hosted and cloud instances where the Git node is enabled and accessible to authenticated users. The issue is resolved in n8n versions 1.123.67, 2.31.5, and 2.32.1. Until patched, administrators can apply temporary mitigations such as restricting user access, disabling the Git node, or limiting network egress to reduce risk.
Potential Impact
An authenticated user with rights to create and execute workflows can achieve arbitrary code execution on the n8n host system. This can lead to full compromise of the host under the privileges of the n8n process user. Both self-hosted and cloud deployments are vulnerable if the Git node is enabled and accessible. The vulnerability is classified as high severity due to the potential for code execution and host compromise.
Mitigation Recommendations
A fix is available in n8n versions 1.123.67, 2.31.5, and 2.32.1 and later; users should upgrade to one of these versions to remediate the vulnerability. If immediate upgrade is not possible, temporary mitigations include restricting n8n instance access to fully trusted users, disabling the Git node by adding 'n8n-nodes-base.git' to the NODES_EXCLUDE environment variable, and restricting network egress from the n8n instance. These mitigations reduce risk but do not fully remediate the vulnerability.
n8n: Authenticated code execution in the n8n Git node
Description
Authenticated users of n8n with workflow creation and execution rights can achieve code execution on the host via the Git node. This occurs when the Git node, under default security settings, processes a crafted local repository that triggers git hooks to run arbitrary commands as the n8n process user. Both self-hosted and cloud instances are affected if these conditions are met. The vulnerability is fixed in n8n versions 1.123.67, 2.31.5, and 2.32.1 and later. Temporary mitigations include restricting access to trusted users, disabling the Git node, and limiting network egress. These mitigations do not fully resolve the risk and upgrading is recommended.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in n8n's Git node allows authenticated users with workflow creation and execution permissions to execute arbitrary code on the host system. The issue arises because the Git node, using default git security settings, can be manipulated via a crafted local repository to cause git hooks to execute commands as the n8n process user. The vulnerability affects both self-hosted and cloud instances where the Git node is enabled and accessible to authenticated users. The issue is resolved in n8n versions 1.123.67, 2.31.5, and 2.32.1. Until patched, administrators can apply temporary mitigations such as restricting user access, disabling the Git node, or limiting network egress to reduce risk.
Potential Impact
An authenticated user with rights to create and execute workflows can achieve arbitrary code execution on the n8n host system. This can lead to full compromise of the host under the privileges of the n8n process user. Both self-hosted and cloud deployments are vulnerable if the Git node is enabled and accessible. The vulnerability is classified as high severity due to the potential for code execution and host compromise.
Mitigation Recommendations
A fix is available in n8n versions 1.123.67, 2.31.5, and 2.32.1 and later; users should upgrade to one of these versions to remediate the vulnerability. If immediate upgrade is not possible, temporary mitigations include restricting n8n instance access to fully trusted users, disabling the Git node by adding 'n8n-nodes-base.git' to the NODES_EXCLUDE environment variable, and restricting network egress from the n8n instance. These mitigations reduce risk but do not fully remediate the vulnerability.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-rcv6-pvrj-4xcg
- Osv Schema Version
- 1.4.0
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
Threat ID: 6a6150cc9c2644c7f8da0159
Added to database: 07/22/2026, 23:22:52 UTC
Last enriched: 07/22/2026, 23:27:45 UTC
Last updated: 07/22/2026, 23:27:45 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.