What happened
VulnCheck published CVE-2026-110845 on 2026-10-14 (CVSS 7.7). n8n normally strips a repository's local configuration (which can name programs git executes) before running commands — but the Log operation, the one that invokes an external program, never applied that protection. A member who can point the node at a repo whose local config they control gets code execution as the n8n process user under default settings, and the node is exposed to AI-agent tool calls. Verified via the GitHub advisory.
Why it matters
AI-agent workflows routinely hand the n8n Git node attacker-influenced repositories (clone/fetch from webhook-triggered URLs or PRs). Local git config settings such as core.sshCommand are a classic git RCE vector; because this executes in the shared n8n process context it is a direct path from a crafted repo that an agent checks out to code execution on the automation server.
Attack vector
An attacker (or a prompt-injected agent workflow) supplies a repository whose local git configuration names programs git will execute; the Git node Log operation — the one operation that invokes an external program — fails to strip the repo's local config, so running it yields program execution as the n8n process user. The node is also usable as an AI-agent tool.
Affected systems
n8n < 1.123.83, 2.x < 2.41.4, 2.42.x < 2.42.1
Mitigation
Upgrade to n8n 1.123.83+, 2.41.4+ or 2.42.1+. Workarounds: restrict instance to trusted users, audit repo local git config for unexpected program-execution keys, or disable the Git node via NODES_EXCLUDE=n8n-nodes-base.git. Advisory: GHSA-x8wx-g24x-3549.