CVE-2025-62726
published 2025-10-30CVE-2025-62726: n8n is an open source workflow automation platform. Prior to 1.113.0, a remote code execution vulnerability exists in the Git Node component available in both…
PriorityP264high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.78%
51.2th percentile
n8n is an open source workflow automation platform. Prior to 1.113.0, a remote code execution vulnerability exists in the Git Node component available in both Cloud and Self-Hosted versions of n8n. When a malicious actor clones a remote repository containing a pre-commit hook, the subsequent use of the Commit operation in the Git Node can inadvertently trigger the hook’s execution. This allows attackers to execute arbitrary code within the n8n environment, potentially compromising the system and any connected credentials or workflows. This vulnerability is fixed in 1.113.0.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| n8n-io | n8n | < 1.113.0 | 1.113.0 |
| n8n | n8n | < 1.113.0 | 1.113.0 |
| n8n | n8n | >= 0 < 1.113.0 | 1.113.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
n8n Vulnerable to Remote Code Execution via Git Node Pre-Commit Hook
ghsa·2025-10-30
CVE-2025-62726 [HIGH] CWE-829 n8n Vulnerable to Remote Code Execution via Git Node Pre-Commit Hook
n8n Vulnerable to Remote Code Execution via Git Node Pre-Commit Hook
### Impact
A remote code execution vulnerability exists in the Git Node component available in both Cloud and Self-Hosted versions of n8n. When a malicious actor clones a remote repository containing a pre-commit hook, the subsequent use of the Commit operation in the Git Node can inadvertently trigger the hook’s execution.
This allows attackers to execute arbitrary code within the n8n environment, potentially compromising the system and any connected credentials or workflows.
All users with workflows that utilize the Git Node to clone untrusted repositories are affected.
### Patches
The vulnerability was addressed in v1.113.0 (n8n-io/n8n#19559), which introduces a new environment variable: `N8N_GIT_NODE_DISABLE_BARE_
OSV
n8n Vulnerable to Remote Code Execution via Git Node Pre-Commit Hook
osv·2025-10-30
CVE-2025-62726 [HIGH] n8n Vulnerable to Remote Code Execution via Git Node Pre-Commit Hook
n8n Vulnerable to Remote Code Execution via Git Node Pre-Commit Hook
### Impact
A remote code execution vulnerability exists in the Git Node component available in both Cloud and Self-Hosted versions of n8n. When a malicious actor clones a remote repository containing a pre-commit hook, the subsequent use of the Commit operation in the Git Node can inadvertently trigger the hook’s execution.
This allows attackers to execute arbitrary code within the n8n environment, potentially compromising the system and any connected credentials or workflows.
All users with workflows that utilize the Git Node to clone untrusted repositories are affected.
### Patches
The vulnerability was addressed in v1.113.0 (n8n-io/n8n#19559), which introduces a new environment variable: `N8N_GIT_NODE_DISABLE_BARE_
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-10-30
Published