n8n: Git Node branch.<name>.remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read

Impact The Git node validated the repository that a fetch or pull targeted, but setUpstream wrote a branch..remote value into the repository's own configuration without validating it. A subsequent fetch or pull resolved the remote from that configuration rather than from the checked parameter, so...

CVE-2026-86995

CVE-2026-86995 affects n8n , an open-source workflow automation platform. The Git node validated the repository parameter for fetch/pull operations, but its setUpstream function wrote a branch..remote value into the repository configuration without validation. A subsequent fetch or pull then reso...

PT-2024-31558 · Gix-Path · Gix-Path

Name of the Vulnerable Software and Affected Versions: gix-path versions prior to 0.10.10 Description: The gix-path crate of the gitoxide project mistakenly treats the local repository's configuration as system-wide if no higher scoped configuration is found. This can cause a less trusted...