n8n EUVD-2026-101728

Exploitation requires an authenticated n8n member (PR:L) with the ability to make the Git node's Log operation point at a repository whose LOCAL git configuration the attacker controls - this includes the scenario where the Git node is exposed as an agent tool that an attacker can steer. The specific flaw is that the Log operation fails to strip the repository's local git config before invoking the external git program, so attacker-controlled config directives cause git to execute arbitrary programs as the n8n process user. Limiting factors: valid authenticated access to n8n is mandatory, the attacker must be able to supply/control the target repository's local configuration (the AT:P 'attack requirement'), and the code runs only with the privileges of the n8n process user rather than inherently as root. Fixed in n8n 1.123.83, 2.41.4, and 2.42.1.

This is a credible but conditional priority, not a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N) and 7.7 HIGH score reflect a full confidentiality/integrity/availability compromise (VC:H/VI:H/VA:H) achievable over the network, but two signals temper it: PR:L means the attacker must already be an authenticated n8n member, and AT:P (attack requirement present) encodes the key precondition - the attacker must control a repository's local git configuration that the Git node's Log operation is pointed at. No EPSS score was provided and the vulnerability is not listed in CISA KEV, so there is no public evidence of active exploitation; exploitation status is best described as 'no public exploit identified at time of analysis.' The 'RCE' tag and CWE-15 (External Control of System or Configuration Setting) are consistent with the described code-execution-via-config mechanism. The practical risk concentrates in multi-tenant or agent-enabled n8n deployments where lower-trust users (or an LLM agent using the Git node as a tool) can supply attacker-controlled repositories - in those environments this is a genuine privilege-escalation-to-RCE path worth prompt patching; in single-operator, fully-trusted deployments the PR:L and AT:P barriers make it a lower operational urgency. No conflicting signals were observed between the vector and description, but EPSS/KEV data is simply absent rather than contradictory.

An authenticated n8n user (or an AI agent invoking the Git node as a tool) configures the node's Log operation to target a repository whose local .git/config they control, embedding a directive (e.g., a config key that causes git to invoke an external program). When n8n runs the Log operation without stripping the repository's local git configuration, git executes the attacker-specified program as the n8n process user, yielding code execution. No public proof-of-concept was identified in the provided intelligence.