n8n: Code Execution in the Git Node Log Operation via Unneutralized Repository Configuration

Impact

A repository's local configuration can name programs that git will execute, so the Git node strips it before running any command. One operation never applied that protection, and it is the operation that invokes an external program. A member who can point the node at a repository whose local configuration they control obtains program execution as the n8n process user under default settings. The node is also usable as an agent tool.

Patches

The issue has been fixed in n8n versions 1.123.83, 2.42.1 and 2.41.4. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

• Restrict n8n instance access to fully trusted users only.
• Audit the file-access root for repositories whose local git configuration contains unexpected program-execution keys and remove or correct them.
• Disable the Git node by adding n8n-nodes-base.git to the NODES_EXCLUDE environment variable if it is not required.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.