---
id: GHSA-rcv6-pvrj-4xcg
title: 'n8n: Authenticated code execution in the n8n Git node'
summary: 'n8n: Authenticated code execution in the n8n Git node'
severity: high
cwe:
  - CWE-78
vendor: n8n
product: n8n
ecosystem: npm
affected:
  - n8n < 1.123.67
  - 'n8n >= 2.32.0, < 2.32.1'
  - 'n8n >= 2.0.0-rc.0, < 2.31.5'
patched:
  - n8n 1.123.67
  - n8n 2.32.1
  - n8n 2.31.5
published: '2026-07-22'
updated: '2026-07-22'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-rcv6-pvrj-4xcg'
references:
  - url: 'https://github.com/n8n-io/n8n/security/advisories/GHSA-rcv6-pvrj-4xcg'
  - url: >-
      https://github.com/n8n-io/n8n/commit/f69dfc6dd2178a14ea1624d2e1d403c2e755042f
  - url: 'https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.67'
  - url: 'https://github.com/n8n-io/n8n/releases/tag/n8n@2.31.5'
  - url: 'https://github.com/n8n-io/n8n/releases/tag/n8n@2.32.1'
  - url: 'https://github.com/advisories/GHSA-rcv6-pvrj-4xcg'
tags:
  - ghsa
  - npm
ingestedAt: '2026-07-22T23:07:33.015Z'
---

## Overview

## Impact

Authenticated n8n users with rights to create and execute workflows could achieve code execution on the n8n host. Using the Git node, under the default `git` security settings, by staging a crafted local repository, an attacker could cause `git` to run hooks, executing arbitrary commands as the n8n process user.

Both self-hosted and cloud instances are affected where authenticated users can create and execute workflows using the Git node.

## Patches

The issue has been fixed in n8n versions 1.123.67, 2.31.5, and 2.32.1. Users should upgrade to one of these versions or later to remediate the vulnerability.

## Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Restrict n8n instance access to fully trusted users only.
- Disable the Git node by adding `n8n-nodes-base.git` to the `NODES_EXCLUDE` environment variable.
- Restrict network egress from the n8n instance to limit the impact of arbitrary code execution.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

## Affected packages

- `n8n < 1.123.67`
- `n8n >= 2.32.0, < 2.32.1`
- `n8n >= 2.0.0-rc.0, < 2.31.5`

## Remediation

Upgrade to a patched release:

- `n8n 1.123.67`
- `n8n 2.32.1`
- `n8n 2.31.5`