n8n: N8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability…
n8n
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-85168
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- September 3, 2026
- Source last modified
- September 16, 2026
Description
n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in the Git node. The node reset a fixed list of command-bearing configuration keys before each operation, but that list did not cover the content-filter and merge-driver key families. A repository with local configuration setting one of those keys together with a matching attribute pattern causes git to execute the configured command during an ordinary Add, Commit, Checkout, or Pull operation. The command runs as the n8n process user.
Description quoted from the NVD record.
Who is affected
n8n is a tool for automating tasks by connecting apps and services into step-by-step workflows. This flaw affects n8n versions before 1.123.73, 2.35.4 and 2.36.2. The problem is in the Git building block, which lets a workflow work with files stored in Git (a system for tracking changes to files). If a workflow uses a repository whose local settings have been set up to include certain commands, an ordinary Add, Commit, Checkout or Pull step can make the computer running n8n carry out those commands, with the same permissions as n8n itself. This flaw is rated High.
What to do
- The person who installed or runs n8n for your organization should handle this advisory.
- Check which version of n8n your organization is running. Versions before
1.123.73,2.35.4and2.36.2are affected. - Update n8n to a fixed version:
1.123.73,2.35.4or2.36.2, or a later release. Check the vendor advisory linked on this page to see which one fits the version you use. - After updating, check that n8n shows the new version number and that your workflows still run as expected.
- If an IT provider or vendor runs n8n for your organization, send them this advisory and ask when the update will be done.
Analysis written from the source record as of September 16, 2026 and reviewed before publishing.