CVE-2026-110845: n8n before 1.123.83, 2.41.4, and 2.42.1 Code Execution via Git Node Log Operation
n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a code execution vulnerability in the Git node Log operation, which fails to strip a repository's local git configuration before invoking an external program. Authenticated members who can point the node, including as an agent tool, at a repository whose local configuration they control can execute programs as the n8n process user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 1.123.83 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.41.4 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.42.1
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An authenticated n8n member must be able to use the Git node Log operation, directly or through an agent tool, and point it at a repository whose local Git configuration they control. The resulting program execution occurs with the privileges of the n8n process user.
Which deployments are affected?
Affected versions are n8n releases before 1.123.83, 2.x releases before 2.41.4, and 2.42.x releases before 2.42.1. The issue is specifically in the Git node Log operation.
What is required for exploitation?
The attacker needs authenticated access and control over the local Git configuration of a repository used by the Git node Log operation. The vulnerable behavior occurs when n8n invokes an external program without first stripping that repository-local configuration.