CVE-2026-92587

n8n is a workflow automation platform. In versions before 1.123.76, 2.37.7, and 2.38.2, the Git node validated a relative remote URL against the configured repositoryPath but then invoked git with that path as its working directory; git walked up to the enclosing repository's top level and resolved the same relative URL from there. An authenticated user (member) who nested the repository one level below the configured path could therefore make an identical URL string pass the file-access check while git resolved it outside the sandbox. A subsequent fetch or pull read a git repository outside N8N_RESTRICT_FILE_ACCESS_TO and merged its objects into the user's own repository, where their contents could be read back. The issue is fixed in n8n 1.123.76, 2.37.7, and 2.38.2, which resolve the remote reference from the directory git actually operates in before applying the sandbox check. As a workaround, the Git node can be disabled by adding n8n-nodes-base.git to NODES_EXCLUDE.

• CWE-426

• https://github.com/n8n-io/n8n/security/advisories/GHSA-fm93-2x43-6676
• https://www.vulncheck.com/advisories/n8n-before-1.123.76-sandbox-escape-via-git-relative-url

Published

Sep 16, 2026

Last Modified

Sep 16, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-92581In AVideo through 29.0, Like::__construct() performs counter…4.3
• CVE-2026-92582AVideo (WWBN/AVideo) through 29.0 (commit e01e41ecc) is vuln…7.1
• CVE-2026-92583AVideo through 29.0 contains a race condition in the enforce…6.5
• CVE-2026-92584AVideo through 29.0 (current revision e01e41ecc) contains a …6.1
• CVE-2026-92585AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78…4.3
• CVE-2026-92586AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78…4.3
• CVE-2026-92588n8n is a workflow automation platform. In n8n versions befor…4.4
• CVE-2026-92589Craft CMS 5.0.0 through 5.10.12 (fixed in 5.10.13) contains …4.3
• CVE-2026-9259Improper validation of server certificates in Canon EOS Netw…9.8
• CVE-2026-92590Craft CMS versions from 5.7.0 before 5.10.13 contain a store…5.4
• CVE-2026-92591Craft CMS 5.0.0 through 5.10.12 treats a database connection…5.9
• CVE-2026-92592Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sig…8.8