CVE-2026-25053

n8n is Vulnerable to OS Command Injection in Git Node

n8n is an open source workflow automation platform. Prior to versions 1.123.10 and 2.5.0, vulnerabilities in the Git node allowed authenticated users with permission to create or modify workflows to execute arbitrary system commands or read arbitrary files on the n8n host. This issue has been patched in versions 1.123.10 and 2.5.0.

Affected

n8n-io · n8n

CVSS v4.0 GITHUB

9.4 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v4.0 GitHub

9.4 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CVSS v3.1 NVD

9.9 CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS

0.63% chance of exploitation in the next 30 days, 49th percentile

Published

2026-02-04

Updated

2026-02-05

Proof-of-concept exploits (1)

• yadhukrishnam/CVE-2026-250532★ · 2026-02-16

Security advisories

• n8n-io/n8n/security/advisories/GHSA-9g95-qf3f-ggrw
• advisories/GHSA-9g95-qf3f-ggrw

References

• CVE Record
• NVD entry