CVE-2026-110845

{
  "etk_id": "ETK-2026-1845",
  "cve_id": "CVE-2026-110845",
  "display_id": "CVE-2026-110845",
  "ghsa_id": "GHSA-qgh4-pf6j-6hwh",
  "euvd_id": "EUVD-2026-101728",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Code execution in n8n Git node Log operation",
  "summary": "n8n's Git node Log operation can execute programs as the n8n process user when it processes attacker-controlled repository-local Git configuration. This affects deployments before 1.123.83, before 2.41.4 on the 2.x line, and before 2.42.1 on the 2.42.x line; an authenticated user must be able to point the node or an agent tool at a repository they control.",
  "mitigation": "Upgrade n8n to 1.123.83, 2.41.4, or 2.42.1, as appropriate for the deployed release line. Until upgraded, restrict access to the Git node and agent tools and prevent them from being directed to untrusted repositories.",
  "vendor": "n8n-io",
  "product": "n8n",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 1.123.83",
        ">= 2.0.0, < 2.41.4",
        ">= 2.42.0, < 2.42.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "1.123.83",
        "2.41.4",
        "2.42.1"
      ],
      "package_name": "n8n",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
  "epss_score": 0.0034,
  "epss_percentile": 0.2555,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 40.940304016666666,
  "t0_at": "2026-10-14T22:52:20.658000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-14T22:52:20.658000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-14T22:52:20.658000+00:00",
      "url": "https://github.com/advisories/GHSA-qgh4-pf6j-6hwh"
    }
  }
}