{"id":"EUVD-2026-60943","enisaUuid":"19e87c57-0cd6-3ddc-bb5d-a177dce50ef5","description":"n8n is an open source workflow automation platform. Prior to 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user to swap a validated directory for a symlink before cloning, planting a crafted repository in the community node directory that loads as a custom JavaScript node after restart and executes arbitrary code on the server. This issue is fixed in versions 1.123.64, 2.29.8, and 2.30.1.","datePublished":"Aug 18, 2026, 2:43:39 PM","dateUpdated":"Aug 19, 2026, 3:56:17 AM","baseScore":8.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:L","references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-g3r5-9h93-4j2c\nhttps://github.com/n8n-io/n8n/releases/tag/n8n@1.123.64\nhttps://github.com/n8n-io/n8n/releases/tag/n8n@2.29.8\nhttps://github.com/n8n-io/n8n/releases/tag/n8n@2.30.1\n","aliases":"CVE-2026-71539\nGHSA-62jr-cqgr-xmh7\n","assigner":"GitHub_M","epss":0.31,"enisaIdProduct":[{"id":"4230ee3f-d979-3202-abcb-95e719661a87","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"2.0.0-rc.0, \u003c 2.29.8"},{"id":"5ce078eb-ce7d-396f-9b64-9777b5c5b2fc","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"2.30.0, \u003c 2.30.1"},{"id":"82dd5cb5-1a8d-34c4-b17e-b1a61d157d54","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"\u003c 1.123.64"}],"enisaIdVendor":[{"id":"f56e99a9-e406-3a76-9e88-0f879da8741b","vendor":{"name":"n8n-io"}}],"enisaIdVulnerability":[{"id":"38c5fc1d-ce61-3de5-99ee-76bf1724e192","vulnerability":{"id":"CVE-2026-71539","description":"n8n is an open source workflow automation platform. Prior to 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user to swap a validated directory for a symlink before cloning, planting a crafted repository in the community node directory that loads as a custom JavaScript node after restart and executes arbitrary code on the server. This issue is fixed in versions 1.123.64, 2.29.8, and 2.30.1.","datePublished":"Aug 18, 2026, 2:43:39 PM","dateUpdated":"Aug 19, 2026, 3:56:17 AM","status":"PUBLISHED","baseScore":8.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:L","references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-g3r5-9h93-4j2c\nhttps://github.com/n8n-io/n8n/releases/tag/n8n@1.123.64\nhttps://github.com/n8n-io/n8n/releases/tag/n8n@2.29.8\nhttps://github.com/n8n-io/n8n/releases/tag/n8n@2.30.1\n","enisa_id":"EUVD-2026-60943\n","assigner":"GitHub_M","epss":0.31,"dataProcessed":"Nov 5, 2026, 7:14:04 AM","vulnerabilityProduct":[{"id":"7f0acde1-0f43-3b43-83d5-7ef0f70dc5b8","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"\u003c 1.123.64"},{"id":"9185187a-65f9-3cff-b8c0-68afcf8d37da","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"2.0.0-rc.0, \u003c 2.29.8"},{"id":"c3f0edf9-f4dc-339d-8894-fc0aae7861e2","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"2.30.0, \u003c 2.30.1"}],"vulnerabilityVendor":[{"id":"ba3f8353-1aa4-3401-aef9-244f53336e85","vendor":{"name":"n8n-io"}}]}},{"id":"edcc69b3-2661-39a0-ae15-0afd4bd31215","vulnerability":{"id":"GHSA-62jr-cqgr-xmh7","description":"n8n is an open source workflow automation platform. Prior to 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user to swap a validated directory for a symlink before cloning, planting a crafted repository in the community node directory that loads as a custom JavaScript node after restart and executes arbitrary code on the server. This issue is fixed in versions 1.123.64, 2.29.8, and 2.30.1.","datePublished":"Aug 18, 2026, 3:31:48 PM","dateUpdated":"Aug 18, 2026, 3:31:48 PM","baseScore":0.0,"references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-g3r5-9h93-4j2c\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-71539\nhttps://github.com/n8n-io/n8n/releases/tag/n8n@1.123.64\nhttps://github.com/n8n-io/n8n/releases/tag/n8n@2.29.8\nhttps://github.com/n8n-io/n8n/releases/tag/n8n@2.30.1\n","enisa_id":"EUVD-2026-60943\n","aliases":"GHSA-62jr-cqgr-xmh7\nCVE-2026-71539\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:04:29 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}