CVE-2026-72767
HighCVSS 8.7Summary
Vulnerability in n8n before versions 1.123.67, 2.31.5, and 2.32.1 allows remote code execution in the Git node. Authenticated users with rights to create and execute workflows can stage a crafted local repository that causes git to run hooks under default git security settings, executing arbitrary commands as the n8n process user. Both self-hosted and cloud instances are affected.
Risk Assessment
The risk includes full compromise of the n8n server, potentially leading to system and data integrity breaches.
Recommendation
Immediately upgrade n8n to versions 1.123.67, 2.31.5, or 2.32.1 which contain the fix.
Original NVD description (English source)
n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a remote code execution vulnerability in the Git node. Authenticated users with rights to create and execute workflows can stage a crafted local repository that causes git to run hooks under default git security settings, executing arbitrary commands as the n8n process user. Both self-hosted and cloud instances are affected.