CVE-2026-85168 is a high severity remote code execution flaw in the n8n Git node. A repository with crafted local configuration can make git run a command during Add, Commit, Checkout or Pull, as the n8n process user. Upgrade to 1.123.73, 2.35.4 or 2.36.2, or disable the node.
What's affected
- Product: n8n (npm package
n8n), Git node. - Affected: before 1.123.73, before 2.35.4, and before 2.36.2.
- Fixed: 1.123.73, 2.35.4 and 2.36.2, or any later release on that line.
- Attack needs: a repository whose local configuration sets a content filter or merge driver key plus a matching attribute pattern, used through the Git node.
Severity in the record: High, CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The GitHub advisory rates it High with 7.7 under CVSS v4. The record carries 8.8 under CVSS v3.1. Both are High.
Weakness class: CWE-78 (OS Command Injection).
How to check if you're exposed
- Find your version. For a global npm install,
n8n --versionprints it. For Docker, rundocker exec my-n8n n8n --version, or read the image tag. - Compare it with the fixed releases below. Remember that n8n has several release lines, so 1.x, 2.35.x and 2.36.x each have their own fixed number.
- Note who holds workflow create and edit rights on the instance, since several n8n flaws start from that privilege.
- Look for workflows that use the Git node on repositories you do not fully control. Those are the ones that matter most.
What to do now
- Upgrade n8n to 1.123.73, 2.35.4, 2.36.2 or later, depending on your release line.
- If you cannot upgrade today, add
n8n-nodes-base.gitto theNODES_EXCLUDEenvironment variable so the Git node cannot run. - Restrict access to the instance to people you trust, and run the n8n process as a dedicated low privilege user.
- Review which repositories your workflows clone or pull, and drop any that you do not control.
- Rotate secrets stored on the host or in n8n credentials if untrusted repositories were ever processed by an affected version.
Why it matters
Git can run external programs for some operations. Content filters and merge drivers are examples, and a repository can ask for them in its own configuration. n8n already reset a list of risky configuration keys before each operation, but the list missed the filter and merge driver families. That is classic incomplete denylisting, tracked as CWE-78.
The impact is code execution as the n8n process user, which on many hosts can reach credentials for every connected service. The n8n advisory says the workarounds reduce but do not remove the risk, so the upgrade is the real fix. Nothing in the record says this CVE is exploited in the wild.
Try it yourself
See how a fixed version shows up against an affected package, and how fast the upgrade decision becomes obvious.
Click through it at your own pace, or open it full screen.
Quick check
Does disabling the Git node fully fix this?
No. The advisory calls it a short term mitigation. Upgrading to a fixed release is the remediation.
Sources
Last reviewed: 18 October 2026.
