Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.4

n8n lets attackers run code via Git node

CVE-2026-110845 · published 1 day ago
Summary

In older versions of n8n, a feature that reads Git logs does not remove a repository's local settings before calling an external program. If a logged‑in user can choose a repository they control, they could make the system run arbitrary commands as the n8n service user. Update n8n to the latest release to close this risk.

What to do
  • Update n8n-io n8n to version 1.123.83 or later.
Affected software
VendorProductAffected versions
n8n-io n8n < 1.123.83
Original advisory text
n8n before 1.123.83, 2.41.4, and 2.42.1 Code Execution via Git Node Log Operation
n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a code execution vulnerability in the Git node Log operation, which fails to strip a repository's local git configuration before invoking an external program. Authenticated members who can point the node, including as an agent tool, at a repository whose local configuration they control can execute programs as the n8n process user.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.4 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-15External Control of System or Configuration Setting
Timeline
Published14 Oct 2026
Updated15 Oct 2026
First seen14 Oct 2026
Sources
CVE-2026-110845 · NVD
CVE-2026-110845 · MITRE
CVE-2026-110845 · OSV
GHSA-x8wx-g24x-3549 · GHSA
Track software like this
Free during beta