WS-2026-0095

n8n Git node Log operation ran git without stripping repository-local configuration that can name programs for git to execute, so a user who controls a repository's local config can execute programs as the n8n process user. Fixed in n8n 1.123.80, 2.39.6 and 2.40.1 n8n-nodes-base 1.121.52 / 2.39.4...

CVE-2026-77084

n8n before 1.123.69 and 2.x before 2.33.4 / 2.34.1 contains a code execution vulnerability in the Git node. The Git node executed certain repository-local git configuration values without neutralizing them, so any subsequent Git node operation against a repository containing a malicious value wou...

PT-2026-78939

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.69 n8n versions 2.x prior to 2.33.4 n8n versions 2.x prior to 2.34.1 Description A code execution issue exists in the Git node. The node executes specific repository-local git configuration values without proper...

CVE-2026-50017

A flaw was found in pnpm, a package manager. This vulnerability allows pnpm to send user-level unscoped npm authentication credentials to a registry specified by a repository-local .npmrc file. During normal pnpm operations, the user's authentication token, intended for their default registry, ca...