CVE-2026-44790

The vulnerability mechanism (CWE-88 — argument injection) consists of the fact that user-supplied input in the Git node Push operation is not properly sanitized before being passed to the command line invocation. An attacker can inject additional CLI flags that are accepted by the Git command and force, for example, reading files outside the intended working directory. As a result, access to arbitrary files available from the n8n process on the server is possible.

An attacker can read arbitrary files from the n8n server, including potentially credentials, API keys, environment configurations, and other sensitive data, which may lead to complete system compromise.

Update n8n to version 1.123.43, 2.22.1, or 2.20.7 (depending on the branch in use). Until the patch is applied, it is recommended to restrict user permissions for creating and modifying workflows to trusted persons only, and to monitor Git node activities.

n8n in versions prior to 1.123.43 (1.x series), 2.22.1 (2.22.x series), and 2.20.7 (2.20.x series). The vulnerability affects only users with permissions to create or modify workflows.