Executive brief
n8n is a workflow automation platform used to build and run business processes. The Git Node component contains a flaw that allows arbitrary code execution when cloning repositories with malicious pre-commit hooks. An attacker can compromise the n8n environment, access connected credentials, and manipulate or steal data from connected workflows.
Technical details
The vulnerability is a code execution flaw (CWE-829: Inclusion of Functionality from Untrusted Control Sphere) in the Git Node component. When a user clones a remote repository containing a pre-commit hook and then performs a commit operation, the hook is executed within the n8n process context. This requires low privileges and network access, with no user interaction needed. An attacker can supply a malicious repository URL to trigger arbitrary command execution. The fix was released in version 1.113.0, which introduces an N8N_GIT_NODE_DISABLE_BARE_REPOS environment variable to disable the vulnerable behavior.
Affected products
- n8n n8n before 1.113.0
Timeline
- 2025-10-30: disclosed
- 2025-10-30: patched: Fixed in version 1.113.0