n8n CVE-2026-77084

Exploitation requires two chained prerequisites to both be satisfied. First, the attacker must hold authenticated access to n8n at PR:L level - sufficient to create or trigger a workflow containing a Git node; anonymous or external-only access is not sufficient. Second, a separate file-write capability must already exist or be obtainable, allowing the attacker to plant a malicious key-value pair (e.g., an arbitrary-command-invoking hook or filter) into the .git/config of a repository that an n8n Git node will subsequently operate against. The Git node's own configuration interface does not expose the vulnerable path - the malicious config must arrive via an external channel such as a cloned adversary-controlled repo, a separate n8n node with file-write capability, or direct filesystem access. n8n instances that use the Git node exclusively against internal, access-controlled repositories with no external contributor influence are substantially less exposed. Deployments that do not use the Git node at all are not affected.

The CVSS 4.0 score of 7.7 with vector AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H correctly reflects the dual nature of this vulnerability: the AT:P (Attack Requirements: Present) metric acknowledges that a specific pre-condition - a malicious git config value planted by a separate file-write primitive - must be satisfied before the OS injection fires, meaningfully elevating real-world exploitation complexity beyond the headline impact metrics alone. PR:L confirms authenticated n8n access is required to invoke a Git node workflow; unauthenticated remote exploitation is not supported by the available data. No EPSS data was provided, and the vulnerability is not listed in CISA KEV, meaning exploitation probability is currently unquantified rather than confirmed low. Any organization running n8n workflows that pull from externally-influenced repositories - where an adversary could contribute or manipulate .git/config - should treat this as urgent regardless of size, since git config poisoning is a realistic, low-noise technique in CI/CD and automation pipeline attack chains. The absence of a public exploit tempers immediate panic but does not eliminate risk, because the technique (abusing git config hooks) is well-understood in the security community and tooling would not be difficult to develop.

An attacker with authenticated n8n access and an existing file-write primitive (e.g., via a second n8n node vulnerability or an overly permissive workflow that writes to the filesystem) writes a malicious core.fsmonitor or core.hooksPath entry into a target repository's .git/config. When any subsequent n8n Git node operation - such as a pull, fetch, or status check - is triggered against that repository, git invokes the injected command as the n8n service account, granting full arbitrary code execution. No public exploit code has been identified at time of analysis, meaning an attacker would currently need to develop tooling independently.