Command injection in n8n - #VU141004
Published: August 5, 2026
Vulnerability identifier: #VU141004
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-77
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to improper neutralization of special elements in repository-local git configuration handling in the n8n Git node when processing a repository with crafted local git configuration values. A remote user can plant a malicious repository-local configuration value to execute arbitrary code.
Exploitation requires a separate file-write vulnerability to place the malicious value in the repository's local configuration, and any subsequent Git node operation against that repository triggers execution as the n8n process user.
Affected software
n8n
Remediation
Install security update from vendor's website.
n8n - addressed in versions 1.123.69, 2.33.4, 2.34.1