CVE-2026-65598

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.64 n8n versions prior to 2.29.8 n8n versions prior to 2.30.1

Description A TOCTOU (Time-of-Check to Time-of-Use) race condition exists in the Git node's clone operation. This occurs when an authenticated user swaps a directory for a symlink after the path has been validated but before the clone operation executes, allowing them to bypass path restrictions. An attacker can use this to place a crafted repository into the community node directory. Because n8n loads these as custom nodes upon restart and executes their JavaScript, this leads to arbitrary code execution on the server. Both self-hosted and cloud instances are affected.

Recommendations Update to version 1.123.64 or later. Update to version 2.29.8 or later. Update to version 2.30.1 or later. Disable the Git node by adding n8n-nodes-base.git to the NODES EXCLUDE environment variable. Restrict n8n instance access to fully trusted users only. Restrict network egress from the n8n instance to prevent connections to attacker-controlled git repositories.