GHSA-qgpw-8g46-w95v: Path Traversal
Impact
The Git node validated the repository that a fetch or pull targeted, but setUpstream wrote a branch.<name>.remote value into the repository's own configuration without validating it. A subsequent fetch or pull resolved the remote from that configuration rather than from the checked parameter, so an authenticated user with workflow-edit permission could point it at any local repository the n8n process could read and receive its contents. The patch validates the branch remote configuration on the same terms as the repository parameter.
Patches
The issue has been fixed in n8n versions 1.123.76, 2.37.7, and 2.38.2. Users should upgrade to one of these versions or later to remediate the vulnerability.
Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict n8n instance access to fully trusted users only. - Disable the Git node by adding n8n-nodes-base.git to the NODESEXCLUDE environment variable. - Ensure the n8n process runs under a dedicated low-privilege OS user account to limit the scope of any filesystem access.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 2.37.7 - Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 2.38.2 - Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 1.123.76 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.123.76 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.37.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.38.2 - Configuration
Disable the Git node by adding n8n-nodes-base.git to the NODES_EXCLUDE environment variable.
n8n Git node (n8n-nodes-base.git) NODES_EXCLUDE = n8n-nodes-base.git - Compensating control
Ensure the n8n process runs under a dedicated low-privilege OS user account to limit filesystem access scope.
- Compensating control
Restrict n8n instance access to fully trusted users only.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated n8n user with permission to edit workflows can exploit it. Exposure is limited by which local repositories the n8n process is able to read.
What access does an attacker need to obtain repository contents?
The attacker needs workflow-edit permission and must be able to configure the Git node so that its upstream branch remote points to a local repository readable by the n8n process. A later fetch or pull uses that configured remote rather than the originally validated repository parameter.
Which versions contain a fix?
The issue is fixed in n8n versions 1.123.76, 2.37.7, and 2.38.2, and later versions. Upgrade to one of those versions or later to remediate it.
What can be done if an upgrade cannot happen immediately?
Restrict the instance to fully trusted users, disable the Git node by setting NODES_EXCLUDE to include n8n-nodes-base.git, and run n8n under a dedicated low-privilege OS account. These measures reduce exposure but do not fully remediate the issue.