{"id":"EUVD-2026-47642","enisaUuid":"933bd16f-80be-3597-8c23-d7b03a15520a","description":"n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node\u0027s clone operation that allows authenticated users to bypass path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This lets an attacker plant a crafted repository in the community node directory, which n8n loads as a custom node on the next restart, executing arbitrary JavaScript on the server. Both self-hosted and cloud instances are affected.","datePublished":"Jul 22, 2026, 11:21:45 AM","dateUpdated":"Oct 29, 2026, 9:16:27 PM","baseScore":8.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:L","references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-g3r5-9h93-4j2c\nhttps://www.vulncheck.com/advisories/n8n-before-remote-code-execution-via-git-clone\n","aliases":"CVE-2026-65598\nGHSA-725q-c4vp-q4cg\nGHSA-g3r5-9h93-4j2c\n","assigner":"VulnCheck","epss":0.33,"enisaIdProduct":[{"id":"2e2e1f6f-9d2f-31d7-a34c-7cb58d4b981d","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"2.0.0-rc.0 \u003c2.29.8"},{"id":"48573e78-324f-38ed-91a3-9eea89c5501b","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"2.30.0 \u003c2.30.1"},{"id":"5adafe58-32f4-3d56-b18f-20b45a9800f5","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"0 \u003c1.123.64"}],"enisaIdVendor":[{"id":"b71e4ba5-54e9-3bbb-bda9-900331ab3f1c","vendor":{"name":"n8n-io"}}],"enisaIdVulnerability":[{"id":"0548327e-037c-313a-9596-5766f9fe69ef","vulnerability":{"id":"GHSA-725q-c4vp-q4cg","description":"Duplicate Advisory: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution","datePublished":"Jul 22, 2026, 12:32:18 PM","dateUpdated":"Jul 22, 2026, 5:54:53 PM","baseScore":0.0,"references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-g3r5-9h93-4j2c\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-65598\nhttps://www.vulncheck.com/advisories/n8n-before-remote-code-execution-via-git-clone\n","enisa_id":"EUVD-2026-47642\n","aliases":"GHSA-725q-c4vp-q4cg\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:58:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"60c222ac-d765-38bf-a31d-ffb0bbbfe4ab","vulnerability":{"id":"CVE-2026-65598","description":"n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node\u0027s clone operation that allows authenticated users to bypass path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This lets an attacker plant a crafted repository in the community node directory, which n8n loads as a custom node on the next restart, executing arbitrary JavaScript on the server. Both self-hosted and cloud instances are affected.","datePublished":"Jul 22, 2026, 11:21:45 AM","dateUpdated":"Oct 29, 2026, 9:16:27 PM","status":"PUBLISHED","baseScore":8.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:L","references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-g3r5-9h93-4j2c\nhttps://www.vulncheck.com/advisories/n8n-before-remote-code-execution-via-git-clone\n","enisa_id":"EUVD-2026-47642\n","assigner":"VulnCheck","epss":0.33,"dataProcessed":"Oct 30, 2026, 12:00:37 PM","vulnerabilityProduct":[{"id":"607bbb70-a49d-3ea9-bd21-81acbefa8e32","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"2.0.0-rc.0 \u003c2.29.8"},{"id":"8ae56326-f8d2-399c-a4fd-23e032b151be","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"2.30.0 \u003c2.30.1"},{"id":"f3ec2317-ab27-372f-91e4-a44ba75d9ea2","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"0 \u003c1.123.64"}],"vulnerabilityVendor":[{"id":"56406b9b-0c50-305d-b4f3-2f1038b12938","vendor":{"name":"n8n-io"}}]}},{"id":"83e856bb-1876-3dee-9376-69a1ab6bf289","vulnerability":{"id":"GHSA-g3r5-9h93-4j2c","description":"n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution","datePublished":"Jul 22, 2026, 5:56:35 PM","dateUpdated":"Jul 22, 2026, 5:56:35 PM","baseScore":0.0,"references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-g3r5-9h93-4j2c\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-65598\nhttps://github.com/n8n-io/n8n\nhttps://github.com/n8n-io/n8n/releases/tag/n8n@1.123.64\nhttps://github.com/n8n-io/n8n/releases/tag/n8n@2.29.8\nhttps://github.com/n8n-io/n8n/releases/tag/n8n@2.30.1\nhttps://www.vulncheck.com/advisories/n8n-before-remote-code-execution-via-git-clone\n","enisa_id":"EUVD-2026-47642\n","aliases":"GHSA-g3r5-9h93-4j2c\nCVE-2026-65598\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:58:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}