n8n TOCTOU race condition in Git node clone operation

Executive brief

n8n is a workflow automation tool used to connect various software services. A security vulnerability in its Git integration allows an authorized user to bypass security restrictions and run malicious code on the server. This could lead to a full system takeover, potentially exposing sensitive data or disrupting automated business processes.

Technical details

A Time-of-Check Time-of-Use (TOCTOU) race condition exists in the Git node's clone operation in n8n. An authenticated attacker can bypass path restrictions by replacing a validated directory with a symbolic link before the clone operation executes. By redirecting the clone to the community node directory, the attacker can plant a malicious repository that n8n loads as a custom node upon the next restart. This results in arbitrary JavaScript execution in the context of the n8n server. The vulnerability affects both self-hosted and cloud instances and is addressed in versions 1.123.64, 2.29.8, and 2.30.1.

Affected products

• n8n n8n < 1.123.64, 2.29.8, 2.30.1

Timeline

• 2026-07-22: advisory: Original advisory published and subsequently withdrawn as a duplicate.

References

• https://api.github.com/users/Malayke
• https://github.com/Malayke
• https://api.github.com/users/Malayke/gists%7B/gist_id%7D
• https://api.github.com/users/Malayke/repos
• https://avatars.githubusercontent.com/u/4935500?v=4
• https://api.github.com/users/Malayke/events%7B/privacy%7D