-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| n8n | npm | >= 0.123.1, < 1.119.2 | 1.119.2 |
Miggo AIRoot Cause AnalysisThe vulnerability allows for remote code execution in n8n's Git node. An attacker can create a workflow that uses the Git node's 'Add Config' operation to set the core.hooksPath configuration to a malicious script within the repository. Subsequent Git operations triggered by the node will then execute this script. The provided patch addresses this by introducing a new security setting, enableGitNodeHooks, which is disabled by default. The patch modifies the execute method in packages/nodes-base/nodes/Git/Git.node.ts. Specifically, it adds logic to push core.hooksPath=/dev/null to the git configuration if hooks are not explicitly enabled. This prevents the execution of any hooks. The vulnerable function is therefore Git.execute, as it is the function that processes the user-provided git configuration and executes git commands, making it the entry point for the exploit.
Git.executepackages/nodes-base/nodes/Git/Git.node.ts
A Semantic Attack on Google Gemini - Read the Latest Research