n8n versions before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 allow an authenticated user to cause the Git node's Log operation to invoke arbitrary programs. The node fails to strip a repository's local Git configuration before calling external commands, enabling an attacker who can control that configuration to run any program as the n8n process user. This leads to code execution with the privileges of the n8n service, potentially compromising confidentiality, integrity, or availability of the system. The vulnerability exploits improper restriction of operations within program bounds (CWE-15).

The vendor is n8n‑io and the product is n8n. The issue exists in all releases prior to 1.123.83, 2.x prior to 2.41.4, and 2.42.x prior to 2.42.1. Users should upgrade to at least 1.123.83 for the 1.x line, 2.41.4 for the 2.41.x line, or 2.42.1 for the 2.42.x line to achieve the fix.

The CVSS score of 7.7 indicates a high severity. EPSS is not available and the vulnerability is not in the KEV list, meaning there is no documented public exploit yet. However, the risk is substantial for any deployment where authenticated users can configure the Git node. The attacker needs authentication and the ability to point the node at a repository they can control locally; with that, they can execute arbitrary code as the n8n process user. The exploitation path relies on manipulating the repository's local git configuration, so the primary attack vector is through privileged configuration changes within the Git node. The potential impact is full code execution on the host running n8n.