Critical · published February 4, 2026
🚨 An authenticated user can run arbitrary commands on your n8n host! This Git node vulnerability allows mischief to thrive if you’re not careful. 🔥 Think of it like a restaurant where the chef has access to the pantry and can create any dish. But what if the chef decides to make a mess and not just dinner? In this case, the chef can throw in ingredients that shouldn’t be there, potentially ruining everything! An attacker with access could wreak havoc, executing system commands or reading sensitive files. This could lead to unauthorized data exposure or even complete system control, putting your workflows and data at serious risk.
Think of it like a restaurant where the chef has access to the pantry and can create any dish. But what if the chef decides to make a mess and not just dinner? In this case, the chef can throw in ingredients that shouldn’t be there, potentially ruining everything! This vulnerability stems from inadequate input validation within the Git node, allowing authenticated users with update permissions to execute arbitrary commands or read files on the n8n server. Now that's a recipe for disaster!
An attacker with access could wreak havoc, executing system commands or reading sensitive files. This could lead to unauthorized data exposure or even complete system control, putting your workflows and data at serious risk. Upgrade to n8n versions 1.123.10 or 2.5.0 to eliminate this vulnerability. Additionally, review user permissions to ensure only trusted individuals can create or modify workflows. Don’t let just anyone in the kitchen! You’ve got this! Patch up and keep your workflows safe and sound! 🛡️