Gogs and n8n patches address critical remote code execution flaws
Two critical vulnerabilities affecting widely used development and automation software have been fixed: a maximum-severity flaw in Gogs and a high-severity workflow-to-remote-code-execution issue in n8n. Gogs tracked the defect as CVE-2026-52813 with a CVSS score of 10.0, while n8n assigned CVE-2026-33696 a CVSS score of 9.4.
Gogs addressed its issue in version 0.14.3. n8n released fixes in versions 2.14.1, 2.13.3, and 1.123.27. The cases underline how functions intended for source-code management and workflow building can become execution paths when validation or object handling fails.
Gogs path traversal can reach Git hook execution
The Gogs flaw stems from accepting organization names containing path traversal sequences such as ../. Repositories created beneath those organizations can then be written to filesystem locations that follow the traversal path.
An attacker can create a nested Git repository structure and overwrite another repository’s hooks configuration, producing remote code execution. Git hooks are designed to run actions at particular repository events, so control of their configuration can turn repository handling into an execution mechanism.
The 0.14.3 release also fixes CVE-2026-52810, a logic issue that permits writing to read-only repositories, and GHSA-6vxv-wg6j-5qwp, an XSS flaw in the outdated jsvine/notebookjs component used to render Jupyter notebook files. Aikido Security was credited with discovering and reporting the Gogs issues.
n8n workflow permissions become a code-execution boundary
The n8n vulnerability affects the XML and GSuiteAdmin nodes in the open-source workflow automation platform. An authenticated user who is allowed to create or modify workflows can exploit prototype pollution and ultimately obtain remote code execution on the n8n instance.
Researcher Simon Koeck said prototype pollution on its own can crash the entire instance. When chained, it can run an attacker’s command as the n8n process user. This makes workflow authoring rights a material security boundary rather than merely an operational permission.
Patch management must cover trusted components
Both disclosures fit a broader pattern in which trusted signed components, legitimate applications, and routine platform features are repurposed for intrusion. In a related example of attackers gaining elevated control on Windows, Lazarus gains Windows SYSTEM privileges through a zero-day shows why execution paths and privilege boundaries require close review even in familiar environments.
Teams running Gogs should update to 0.14.3 and examine organization naming and repository creation controls. n8n operators should deploy the relevant fixed version, restrict workflow creation and modification to necessary users, and review the privileges assigned to the n8n process. The practical business implication is that patching these products must be paired with least-privilege administration, because normal repository and workflow functions can otherwise become direct routes to code execution.