# n8n TOCTOU race condition in Git node clone operation

Source: https://junglewise.ai/threats/n8n-toctou-race-condition-in-git-node-clone-operation-1ccac220  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-22. Updated: 2026-07-22  
License: CC BY 4.0 with a link back

Severity: high · CVSS 8.9 · Published 2026-07-22

n8n is a workflow automation tool used to connect various software services. A security vulnerability in its Git integration allows an authorized user to bypass security restrictions and run malicious code on the server. This could lead to a full system takeover, potentially exposing sensitive data or disrupting automated business processes.

Technologies: [N8n](https://junglewise.ai/threats/technologies/n8n). Vendors: [N8n](https://junglewise.ai/threats/vendors/n8n).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** High severity, with a CVSS score of 8.9, published 22 July 2026.

**Which products and versions are affected?** N8n < 1.123.64, 2.29.8, 2.30.1.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is This vulnerability attacked?** It is attacked over the network, in a network appliance.

**Am I affected?** Check whether you run N8n at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Time-of-Check Time-of-Use (TOCTOU) race condition exists in the Git node's clone operation in n8n. An authenticated attacker can bypass path restrictions by replacing a validated directory with a symbolic link before the clone operation executes. By redirecting the clone to the community node directory, the attacker can plant a malicious repository that n8n loads as a custom node upon the next restart. This results in arbitrary JavaScript execution in the context of the n8n server. The vulnerability affects both self-hosted and cloud instances and is addressed in versions 1.123.64, 2.29.8, and 2.30.1.

## Affected products

- n8n n8n < 1.123.64, 2.29.8, 2.30.1

## Timeline

- 2026-07-22: advisory: Original advisory published and subsequently withdrawn as a duplicate.

## References

- [https://api.github.com/users/Malayke](https://api.github.com/users/Malayke)
- [https://github.com/Malayke](https://github.com/Malayke)
- [https://api.github.com/users/Malayke/gists%7B/gist_id%7D](https://api.github.com/users/Malayke/gists%7B/gist_id%7D)
- [https://api.github.com/users/Malayke/repos](https://api.github.com/users/Malayke/repos)
- [https://avatars.githubusercontent.com/u/4935500?v=4](https://avatars.githubusercontent.com/u/4935500?v=4)
- [https://api.github.com/users/Malayke/events%7B/privacy%7D](https://api.github.com/users/Malayke/events%7B/privacy%7D)

## Related threats

- [n8n path traversal in Databricks node](https://junglewise.ai/threats/cve-2026-119557-n8n-from-2-14-0-through-2-46-3-contains-a-path-traversal)
- [n8n remote code execution in deprecated Function nodes](https://junglewise.ai/threats/cve-2026-119408-n8n-before-2-42-6-2-43-x-before-2-43-3-and-3-x-before-3-0-1)
- [n8n Slack Trigger SSRF and token exfiltration](https://junglewise.ai/threats/cve-2026-118679-n8n-before-1-123-83-2-41-4-and-2-42-1-contains-a-server-side)
- [n8n prototype pollution in workflow history compaction](https://junglewise.ai/threats/cve-2026-118678-n8n-before-2-41-4-and-2-42-x-before-2-42-1-contains-a-prototype)
- [n8n Local Gateway deep-link missing confirmation re-pairing](https://junglewise.ai/threats/cve-2026-118677-n8n-before-2-41-4-and-2-42-x-before-2-42-1-contains-a-missing)