CyberRota Analysis
AI-GeneratedThe vulnerability affects n8n versions prior to 1.123.69 and 2.x before 2.33.4 / 2.34.1, specifically within the Git node, which improperly executes local git configuration values without sanitization. This could allow an attacker to execute arbitrary code as the n8n process user if a malicious value is introduced via a separate file-write vulnerability. Organizations using n8n should prioritize patching this vulnerability to mitigate the risk of unauthorized code execution.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
n8n before 1.123.69 (and 2.x before 2.33.4 / 2.34.1) contains a code execution vulnerability in the Git node. The Git node executed certain repository-local git configuration values without neutralizing them, so any subsequent Git node operation against a repository containing a malicious value would execute it as the n8n process user. This is not reachable through the Git node's own configuration controls and requires a separate file-write vulnerability elsewhere to plant the malicious value.
Related CVEs
Other vulnerabilities affecting the same vendor(s)