Nixpkgs Security Tracker

Login with GitHub

Details of issue NIXPKGS-2026-0115

NIXPKGS-2026-0115
published on 5 Feb 2026
Permalink CVE-2026-25053
updated 2 weeks, 2 days ago by @LeSuisse Activity log
  • Created automatic suggestion 2 weeks, 3 days ago
  • @LeSuisse removed package n8n-nodes-carbonejs 2 weeks, 2 days ago
  • @LeSuisse accepted 2 weeks, 2 days ago
  • @LeSuisse published on GitHub 2 weeks, 2 days ago
n8n is Vulnerable to OS Command Injection in Git Node

n8n is an open source workflow automation platform. Prior to versions 1.123.10 and 2.5.0, vulnerabilities in the Git node allowed authenticated users with permission to create or modify workflows to execute arbitrary system commands or read arbitrary files on the n8n host. This issue has been patched in versions 1.123.10 and 2.5.0.

Affected products

n8n
  • ==< 2.5.0
  • ==< 1.123.10

Matching in nixpkgs

Package maintainers

Upstream advisory: https://github.com/n8n-io/n8n/security/advisories/GHSA-9g95-qf3f-ggrw