The vulnerability exists in n8n’s Git node Push operation. Prior to versions 1.123.43, 2.22.1, and 2.20.7, an authenticated user who can create or modify workflows could inject command‑line flags into this operation, enabling the server to read arbitrary files on the host. This flaw, identified as CWE‑88, allows attackers to obtain sensitive data or potentially compromise the entire system. The issue has been fixed in the aforementioned releases.

The affected product is n8n, the open‑source workflow automation platform by n8n‑io.123.43, 2.22.1, and 2.20.7 are vulnerable. The issue is fixed in those releases, and later versions are considered safe.

The CVSS score of 9.4 marks this issue as critical. Based on the description, it is inferred that the attacker must have authentication and permission to create or modify workflows; no privileged system accounts are required. An attacker can inject malicious CLI flags during a Push operation to read arbitrary files on the host. The EPSS score is not available, so the current exploitation probability cannot be quantified, but the high severity and lack of privilege restriction imply a significant risk. The vulnerability is not listed in CISA KEV, yet the potential for full system compromise warrants urgent attention.