9.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25049

CVE-2026-25049: n8n Has an Expression Escape Vulnerability Leading to RCE

n8n is an open source workflow automation platform. Prior to versions 1.123.17 and 2.5.2, an authenticated user with permission to create or modify workflows could abuse crafted expressions in workflow parameters to trigger unintended system command execution on the host running n8n. This issue has been patched in versions 1.123.17 and 2.5.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25049

CVE-2026-25049:

9.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
n8n	npm	< 1.123.17	1.123.17
n8n	npm	>= 2.0.0, < 2.5.2	2.5.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the 'Git' node of n8n. Specifically, the execute method of the Git class does not sanitize the output of the git.listConfig() command. The patch commits 7860896909b3d42993a36297f053d2b0e633235d and 936c06cfc1ad269a89e8ef7f8ac79c104436d54b address this by introducing a new function sanitizeUrl which strips credentials from git remote URLs, and a function mapGitConfigList that applies this sanitization. The vulnerable code in Git.node.ts is a loop that iterates over the configuration values and adds them to the output. This loop is replaced by a call to the new mapGitConfigList function. An attacker could create a git repository with a malicious remote URL containing an n8n expression in the user-info part. When a user configures the n8n Git node to interact with this repository and lists the configuration, the malicious expression is injected into the workflow's data. Subsequent processing of this data by the n8n expression engine leads to RCE. Therefore, the Git.execute function is the vulnerable function as it's responsible for introducing the malicious data into the system.

Vulnerable functions

Git.execute

packages/nodes-base/nodes/Git/Git.node.ts

The `execute` method in the Git node, when performing the `config:list` operation, directly returns git configuration values without sanitization. An attacker can craft a malicious git repository with expressions in the config's remote URL (e.g., in the username part). When the Git node reads this configuration, the malicious expression is passed into the n8n workflow data. If this data is later evaluated by n8n's expression engine, it can lead to Remote Code Execution (RCE). The patch fixes this by sanitizing the URL values from the git config, removing potentially malicious parts like username and password.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.