CVSS 4.0
7.1 highCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NCVE-2026-86081
High (7.1). EPSS 0.6% chance of exploitation in the next 30 days. Fixed in n8n 1.123.76, 2.37.7, 2.38.2.
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node clone operation matched an attacker-controlled destination path against the default N8N_BLOCK_FILE_PATTERNS regular expression. The pattern ^(./).git(/.)$ allowed catastrophic backtracking and ran synchronously in the main n8n process. An authenticated workflow editor could therefore freeze the instance with one workflow execution; the affected default is declared in packages/@n8n/config/src/configs/security.config.ts. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.
Severity
- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 46% of CVEs (scores of 2026-10-31)
- CWE
- CWE-1333
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-j535-v25q-vx3q | npm | n8n | <1.123.76 | 1.123.76 |
| GHSA-j535-v25q-vx3q | npm | n8n | >=2.38.0 <2.38.2 | 2.38.2 |
| GHSA-j535-v25q-vx3q | npm | n8n | >=2.0.0 <2.37.7 | 2.37.7 |