VYPR
← All advisories
Medium severity4.3NVD Advisory· Published Sep 8, 2026· Updated Sep 10, 2026

CVE-2026-86995

CVE-2026-86995

Description

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node validated the repository parameter for fetch or pull, but setUpstream wrote a branch..remote value into repository configuration without validating it. A later fetch or pull resolved the remote from that configuration instead of the checked parameter. An authenticated workflow editor could therefore point Git at any local repository readable by the n8n process and receive its contents through packages/nodes-base/nodes/Git/GenericFunctions.ts. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
n8nnpm
< 1.123.761.123.76
n8nnpm
>= 2.38.0, < 2.38.22.38.2
n8nnpm
>= 2.0.0, < 2.37.72.37.7

Affected products

1
  • N8n Io/N8nllm-fuzzy
    Range: <1.123.76, <2.37.7, <2.38.2

Patches

Vulnerability mechanics

References

6

News mentions

1