Description (CNA)
n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a code execution vulnerability in the Git node Log operation, which fails to strip a repository's local git configuration before invoking an external program. Authenticated members who can point the node, including as an agent tool, at a repository whose local configuration they control can execute programs as the n8n process user.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n8n-io / n8n | affected 0 before 1.123.83; affected 2.0.0 before 2.41.4; affected 2.42.0 before 2.42.1 |
CWE
CWE-15