9.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25053

CVE-2026-25053: n8n is Vulnerable to OS Command Injection in Git Node

n8n is an open source workflow automation platform. Prior to versions 1.123.10 and 2.5.0, vulnerabilities in the Git node allowed authenticated users with permission to create or modify workflows to execute arbitrary system commands or read arbitrary files on the n8n host. This issue has been patched in versions 1.123.10 and 2.5.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25053

CVE-2026-25053:

9.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
n8n	npm	>= 2.0.0, < 2.5.0	2.5.0
n8n	npm	< 1.123.10	1.123.10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the 'Git' node of n8n and is an OS Command Injection. The analysis of the provided patch commit 503f29901c568d15778e5e853e804b6e5a7a96db clearly shows that user-controlled parameters were not being sanitized correctly. Specifically, the pathsToAdd parameter for add and commit operations, and the reference parameter for the reflog operation were vulnerable. The patch introduces sanitization and uses the -- argument to prevent command injection. This indicates that the execute method of the Git class in packages/nodes-base/nodes/Git/Git.node.ts is the vulnerable function, as it is responsible for processing these user-provided parameters and executing the git commands.

Vulnerable functions

Git.execute

packages/nodes-base/nodes/Git/Git.node.ts

The `execute` method in the `Git` node is vulnerable to OS command injection. The `pathsToAdd` and `reference` parameters, which are user-controlled, were not properly sanitized before being used in `git` command executions. An attacker could inject malicious arguments by crafting a special value for these parameters. For example, a `pathsToAdd` value starting with a hyphen could be interpreted as a command-line option by the `git add` or `git commit` commands. The patch mitigates this by adding the '--' separator to the `git add` and `git commit` commands, which tells git to treat subsequent arguments as file paths, and by adding validation to the `reference` parameter to disallow values starting with a hyphen.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.