highJul 22, 2026

n8n Git Node fetch/pull/pushTags Operations Bypass Sandbox Path Restriction

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

Authenticated n8n users can point a Git remote at an arbitrary local path and use the fetch, pull, or pushTags operations to read files and history from outside the intended sandbox.

Packagen8n
Ecosystemnpm
Affected< 1.123.67
Fixed in1.123.67

The problem

The n8n Git node's clone and push operations had path-containment checks, but fetch, pull, and pushTags did not. Any authenticated user with workflow create or execute rights could exploit this gap.

By configuring a Git remote whose URL points to a local filesystem path outside the restricted directory, an attacker triggers one of the unguarded operations and pulls the target repository's full history into the workspace. From there, the files are readable through normal workflow nodes.

Proof of concept

A working proof-of-concept for this issue in n8n, with the exact payload below.

bash
# Step 1: use the Git node "Add Config" operation to point a remote at an out-of-sandbox path
# Repository Path (allowed sandbox dir): /home/n8n/data/repo
# Operation: Add Config
# Key:   remote.exfil.url
# Value: /home/n8n/.n8n   (or any local path outside the sandbox, e.g. /root/.ssh)

# Step 2: trigger the unguarded operation on that remote
# Operation: fetch   (or pull / pushTags)
# Remote:    exfil

# The sandbox check is skipped; simpleGit runs:
#   git -C /home/n8n/data/repo fetch exfil
# Git resolves the local path and fetches the target repo's objects.
# Step 3: read the exfiltrated content via subsequent Git node operations (log, show, etc.)

The root cause is an incomplete allowlist: the repositoryPath sandbox validation was applied to clone and push but not to fetch, pull, or pushTags (CWE-22). The simpleGit library calls the underlying git binary directly, bypassing n8n's framework-level file-access helpers that protect other nodes.

The patch commit f69dfc6 extended the same path-containment guard that already existed for clone/push to also run before fetch, pull, and pushTags are executed. Because git natively accepts local filesystem paths as remote URLs, no protocol smuggling is needed; a plain absolute path is sufficient to escape the sandbox.

The fix

Upgrade to n8n 1.123.67, 2.31.5, or 2.32.1 or later. All three versions include commit f69dfc6, which extends the sandbox path check to the fetch, pull, and pushTags operations. If an immediate upgrade is not possible, set the environment variable NODES_EXCLUDE=n8n-nodes-base.git to disable the Git node entirely, or restrict instance access to fully trusted users only.

Reported by Yadhu Krishna M.

References: [1][2][3][4][5][6]

Related research