The vulnerability is an OS Command Injection in the Git node of the n8n workflow automation platform. Authenticated users who have permission to create or modify workflows can supply malicious input that the system passes directly to the operating system shell, allowing the execution of arbitrary commands or the reading of arbitrary files on the host machine. This flaw maps to CWE-78 and provides an attacker with full control over the underlying host.

Affected are n8n-io:n8n versions prior to 1.123.10 in the 1.x series and prior to 2.5.0 in the 2.x series. Any deployment that uses a Git node in a workflow and runs one of those versions is vulnerable. Deployments of the patched releases are not affected.

The CVSS score of 9.4 indicates a high severity. The EPSS score is less than 1%, suggesting that real‑world exploitation is unlikely at present, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated session with permissions to edit workflows; once such access is achieved, the attacker can execute shell commands directly on the host. Thus, the risk is significant for installations that expose workflow creation or modification privileges to untrusted users.