GHSA-gf29-4f56-r2jf: n8n: Git Node fetch/pull/pushTags Operations Bypass Sandbox Path Restriction

n8n restricts the Git node to repositories inside an allowed workspace path. That containment check ran for clone and push, but not for fetch, pull or push-tags (CWE-22, path traversal). An attacker sets an allowlisted remote configuration value to a local filesystem path outside the sandbox. Running a pull then copies that local git repository into the workspace. The attacker reads its files and commit history through normal workflow output.

The attacker must be an authenticated user who can create or execute workflows. No user interaction is needed. The vector rates confidentiality impact as high on the n8n host and integrity and availability as none.

What leaks depends on which git repositories exist on the host: source code, config files, or secrets committed to history. The flaw only reaches directories that are git repositories. It does not give general file read or code execution on its own.

Affected: n8n below 1.123.67 on the 1.x line, 2.0.0-rc.0 up to but not including 2.31.5, and 2.32.0. Instances where the Git node is available to users who are not fully trusted are the exposed ones.

Check the version:

npm ls n8n

For Docker, check the image tag or the version in the UI.

Upgrade to n8n 1.123.67, 2.31.5 or 2.32.1, or later. For an npm install, run npm install [email protected].

Temporary mitigations from the advisory, neither of which fully removes the risk:

• Restrict instance access to fully trusted users.
• Add n8n-nodes-base.git to the NODES_EXCLUDE environment variable to disable the Git node.

Review workflows that use the Git node with fetch, pull or push-tags operations. Look for remote configuration values that are local filesystem paths rather than https or ssh URLs, particularly paths outside the n8n workspace. Check the workspace for git repositories you did not put there, such as copies of other directories on the host. Review execution history for unexpected Git node runs by member accounts.

Impact

Authenticated n8n users with workflow create/execute rights could use the Git node's fetch, pull, or push-tags operations to bypass the repository-path containment checks that already protected clone and push. By pointing an allowlisted remote configuration value at a local path outside the intended sandbox, an attacker could pull an arbitrary local git repository into the workspace and subsequently read its files and history.

Patches

The issue has been fixed in n8n versions 1.123.67, 2.31.5, and 2.32.1. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

• Restrict n8n instance access to fully trusted users only.
• Disable the Git node by adding n8n-nodes-base.git to the NODES_EXCLUDE environment variable.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.