n8n: N8n before 1.123.69 (and 2.x before 2.33.4 / 2.34.1) contains a code execution vulnerability in…
n8n
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-77084
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- August 20, 2026
- Source last modified
- September 1, 2026
Description
n8n before 1.123.69 (and 2.x before 2.33.4 / 2.34.1) contains a code execution vulnerability in the Git node. The Git node executed certain repository-local git configuration values without neutralizing them, so any subsequent Git node operation against a repository containing a malicious value would execute it as the n8n process user. This is not reachable through the Git node's own configuration controls and requires a separate file-write vulnerability elsewhere to plant the malicious value.
Description quoted from the NVD record.
Who is affected
n8n is a tool for automating tasks by connecting apps and services into workflows. This flaw affects n8n versions before 1.123.69, and 2.x versions before 2.33.4 or 2.34.1. The problem is in the Git building block, which lets a workflow work with code repositories. If a harmful setting has been planted inside a repository, any later Git step on that repository would run it. This would let an attacker run commands with the same access as n8n itself. Planting that setting requires a separate flaw elsewhere that lets someone write files. This flaw is rated High.
What to do
- Find out who looks after n8n for your organization: the person who installed or runs it, or the IT provider or vendor who manages it for you.
- If your organization runs n8n itself, that person should update it. Versions in the 1.x line should go to
1.123.69or later. Versions in the 2.x line should go to2.33.4or2.34.1or later. - If an IT provider or vendor runs n8n for you, send them this advisory and ask when the update will be done.
- If you are unsure which 2.x release fits your installation, check the vendor advisory linked on this page before updating.
Analysis written from the source record as of September 1, 2026 and reviewed before publishing.