CyberRota Analysis
AI-GeneratedThe Git node in n8n versions prior to 1.123.76, 2.37.7, and 2.38.2 is vulnerable due to improper validation of the repository parameter, allowing an authenticated workflow editor to access any local repository readable by the n8n process. This could lead to unauthorized data exposure through the fetching of sensitive repository contents. Organizations using affected versions of n8n should prioritize upgrading to the patched versions to mitigate potential data leaks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node validated the repository parameter for fetch or pull, but setUpstream wrote a branch..remote value into repository configuration without validating it. A later fetch or pull resolved the remote from that configuration instead of the checked parameter. An authenticated workflow editor could therefore point Git at any local repository readable by the n8n process and receive its contents through packages/nodes-base/nodes/Git/GenericFunctions.ts. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.
Related CVEs
Other vulnerabilities affecting the same vendor(s)