high8.8
CVE-2026-72767
n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a remote code execution vulnerability in the Git node.
Impact
n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a remote code execution vulnerability in the Git node. Authenticated users with rights to create and execute workflows can stage a crafted local repository that causes git to run hooks under default git security settings, executing arbitrary commands as the n8n process user. Both self-hosted and cloud instances are affected.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| N8n | N8n | before 1.123.67 from 2.0.0 before 2.31.5 Version 2.32.0 |