Sandbox Escape Vulnerability in n8n Workflow Automation Platform

CVE-2026-92587

What is CVE-2026-92587?

The n8n workflow automation platform has a vulnerability in its Git node that allows an authenticated user to bypass file access checks by using a relative remote URL. In versions prior to 1.123.76, 2.37.7, and 2.38.2, the Git node improperly validated the remote URL against the configured repositoryPath. This oversight permitted the git command to resolve the URL outside the intended sandbox directory, enabling unauthorized access to repository contents outside the designated path. Users should ensure they are running the corrected versions to mitigate this risk, and can disable the Git node as a temporary workaround by configuring NODES_EXCLUDE accordingly.

References