Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.3
CVE-2026-92587: n8n lets users read files from outside its sandbox
CVE-2026-92587 · published 1 month ago
Summary
The Git feature in n8n versions before the latest updates can be tricked into accessing a repository outside the allowed area, letting an authenticated user view data they shouldn't see. This occurs because the tool checks the path incorrectly before running Git commands. Upgrade to the newest n8n release or disable the Git node as a temporary measure.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| n8n-io | n8n |
< 1.123.76 < 2.38.2 < 2.37.7 |
Original advisory text
n8n before 1.123.76 Sandbox Escape via Git Relative URL
n8n is a workflow automation platform. In versions before 1.123.76, 2.37.7, and 2.38.2, the Git node validated a relative remote URL against the configured repositoryPath but then invoked git with that path as its working directory; git walked up to the enclosing repository's top level and resolved the same relative URL from there. An authenticated user (member) who nested the repository one level below the configured path could therefore make an identical URL string pass the file-access check while git resolved it outside the sandbox. A subsequent fetch or pull read a git repository outside N8N_RESTRICT_FILE_ACCESS_TO and merged its objects into the user's own repository, where their contents could be read back. The issue is fixed in n8n 1.123.76, 2.37.7, and 2.38.2, which resolve the remote reference from the directory git actually operates in before applying the sandbox check. As a workaround, the Git node can be disabled by adding n8n-nodes-base.git to NODES_EXCLUDE.
References
- https://github.com/n8n-io/n8n/security/advisories/GHSA-fm93-2x43-6676 Vendor Advisory
- https://www.vulncheck.com/advisories/n8n-before-1.123.76-sandbox-escape-via-git-... Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92587... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-92587 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.3
High
Type
CWE-426Untrusted Search Path
Timeline
Published16 Sep 2026
Updated31 Oct 2026
First seen16 Sep 2026
Track software like this
Free during beta