AI Threat AlertCVE-2026-77084: n8n: RCE via unsanitized Git node config values
HIGHn8n's Git node executes certain repository-local git configuration values without sanitizing them, so any workflow that runs a Git node operation against a compromised repository executes attacker-controlled commands as the n8n process user. This is a chained vulnerability — it isn't reachable through the Git node's own settings and requires a separate file-write flaw elsewhere to plant the malicious config value first, which meaningfully narrows the practical attack surface. There's no CISA KEV listing, no public exploit, and no Nuclei template, and EPSS data isn't available, so opportunistic mass exploitation is unlikely today; the real risk is a targeted attacker chaining this with another n8n bug or a poisoned third-party repository. n8n sits squarely in AI agent orchestration stacks with 16 downstream dependents and 201 other CVEs in the package's history, and an OpenSSF Scorecard of 6.6/10 signals middling supply-chain hygiene. Patch to n8n 1.123.69 (or 2.x 2.33.4/2.34.1) and audit any workflows that run Git node operations against externally-sourced or user-writable repositories in the meantime.
What is the risk?
Moderate-severity chained vulnerability: standalone it is not exploitable, since it depends on a separate file-write primitive to seed a malicious git config value (e.g., core.fsmonitor, core.pager, or a hook-like config entry) inside a repository the Git node will later operate on. Once chained, impact is full code execution as the n8n process user — high blast radius given n8n frequently holds credentials, API keys, and connections to downstream AI agent tools and services. Exploitability today is low (no KEV, no public PoC, no scanner template, EPSS unavailable) but the precondition is plausible in any n8n deployment that lets less-trusted users create workflows, connect external git repos, or write files reachable by other nodes.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| n8n | npm | — | No patch |
Do you use n8n? You're affected.
How severe is it?
What should I do?
1 stepPatch to n8n 1.123.69 (1.x) or 2.33.4/2.34.1 (2.x) immediately. Until patched, audit workflows for any that combine file-write nodes with subsequent Git node operations against the same repository, and treat any repository cloned or referenced by a Git node as untrusted input — do not run Git node operations against repos with unvetted or externally-writable contents. Restrict which users/roles can configure Git node credentials and target repos. Monitor the n8n host process for unexpected child processes or shell invocations correlated with workflow executions, and review recent workflow execution logs for anomalous Git node activity. Since exploitation requires a separate file-write bug, also prioritize patching any other known n8n vulnerabilities that allow arbitrary file writes.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-77084?
n8n's Git node executes certain repository-local git configuration values without sanitizing them, so any workflow that runs a Git node operation against a compromised repository executes attacker-controlled commands as the n8n process user. This is a chained vulnerability — it isn't reachable through the Git node's own settings and requires a separate file-write flaw elsewhere to plant the malicious config value first, which meaningfully narrows the practical attack surface. There's no CISA KEV listing, no public exploit, and no Nuclei template, and EPSS data isn't available, so opportunistic mass exploitation is unlikely today; the real risk is a targeted attacker chaining this with another n8n bug or a poisoned third-party repository. n8n sits squarely in AI agent orchestration stacks with 16 downstream dependents and 201 other CVEs in the package's history, and an OpenSSF Scorecard of 6.6/10 signals middling supply-chain hygiene. Patch to n8n 1.123.69 (or 2.x 2.33.4/2.34.1) and audit any workflows that run Git node operations against externally-sourced or user-writable repositories in the meantime.
Is CVE-2026-77084 actively exploited?
No confirmed active exploitation of CVE-2026-77084 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-77084?
Patch to n8n 1.123.69 (1.x) or 2.33.4/2.34.1 (2.x) immediately. Until patched, audit workflows for any that combine file-write nodes with subsequent Git node operations against the same repository, and treat any repository cloned or referenced by a Git node as untrusted input — do not run Git node operations against repos with unvetted or externally-writable contents. Restrict which users/roles can configure Git node credentials and target repos. Monitor the n8n host process for unexpected child processes or shell invocations correlated with workflow executions, and review recent workflow execution logs for anomalous Git node activity. Since exploitation requires a separate file-write bug, also prioritize patching any other known n8n vulnerabilities that allow arbitrary file writes.
What systems are affected by CVE-2026-77084?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow orchestration pipelines, CI/CD-integrated agent automation.
What is the CVSS score for CVE-2026-77084?
No CVSS score has been assigned yet.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0010.005AI Agent ToolAML.T0050Command and Scripting InterpreterCompliance Controls Affected
What are the technical details?
Original Advisory
n8n before 1.123.69 (and 2.x before 2.33.4 / 2.34.1) contains a code execution vulnerability in the Git node. The Git node executed certain repository-local git configuration values without neutralizing them, so any subsequent Git node operation against a repository containing a malicious value would execute it as the n8n process user. This is not reachable through the Git node's own configuration controls and requires a separate file-write vulnerability elsewhere to plant the malicious value.
Exploitation Scenario
An attacker first exploits an unrelated file-write vulnerability in n8n (or abuses a workflow node that writes attacker-controlled content to disk) to plant a malicious value into a repository-local git configuration file — for instance, setting a config key that git resolves to an executable command. The attacker then waits for (or triggers) a legitimate workflow that runs a Git node operation (clone, pull, fetch, etc.) against that same repository. When the Git node executes, git itself invokes the poisoned configuration value as a command, running arbitrary code as the n8n process user. From there, the attacker can exfiltrate stored credentials, pivot to other services n8n orchestrates (including AI agent tools and APIs), or establish persistence on the host.
Weaknesses (CWE)
CWE-78Improper Neutralization of Special Elements used in an OS CommandPrimaryCWE-78Improper Neutralization of Special Elements used in an OS CommandCWE-78 — Improper Neutralization of Special Elements used in an OS Command: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.
- [Architecture and Design] If at all possible, use library calls rather than external processes to recreate the desired functionality.
- [Architecture and Design, Operation] Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.
Source: MITRE CWE corpus.
References
Timeline
Related Vulnerabilities
CVE-2026-3366310.0n8n: member role steals plaintext HTTP credentials
Same package: n8nCVE-2026-3366010.0TensorFlow: type confusion NPD in tensor conversion
Same package: n8nCVE-2026-2185810.0n8n: Input Validation flaw enables exploitation
Same package: n8nCVE-2026-275779.9n8n: Code Injection enables RCE
Same package: n8nCVE-2026-274949.9n8n: security flaw enables exploitation
Same package: n8n