CVE-2026-85168

n8n's Git node resets only a fixed list of command-bearing git configuration keys before each operation, and that list omits the content-filter and merge-driver key families, leaving values set in a repository's local configuration active during git runs. An attacker who can influence the configuration of a repository used by the Git node — for example by pairing an attribute pattern with a configured filter or merge-driver command — causes arbitrary commands to execute when a workflow performs an ordinary Add, Commit, Checkout, or Pull operation. The injected command runs with the privileges of the n8n process user, yielding code execution on the n8n host and access to its data and credentials. All n8n instances before 1.123.73, 2.35.4, and 2.36.2 that run the Git node against repositories whose configuration can be attacker-controlled are affected. No public proof of concept is known, the CVSS 4.0 score is 7.7 (high), EPSS is a modest 0.4%, and the issue is not in CISA KEV, so no in-the-wild exploitation has been reported.

What to do: Upgrade n8n to 1.123.73, 2.35.4, or 2.36.2 (or later) on the corresponding release branch. Until patched, restrict the Git node to repositories whose local git configuration and attribute patterns cannot be modified by untrusted users, and audit existing repositories for content-filter and merge-driver configuration keys paired with attribute patterns. Run the n8n process under a least-privileged account to limit the impact of any command execution.