Description
n8n is an open source workflow automation platform. Prior to 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user to swap a validated directory for a symlink before cloning, planting a crafted repository in the community node directory that loads as a custom JavaScript node after restart and executes arbitrary code on the server. This issue is fixed in versions 1.123.64, 2.29.8, and 2.30.1.
Published: 2026-08-18
Score: 8.9 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a race condition in the Git clone node of n8n. An authenticated workflow user can replace a validated directory with a symbolic link before cloning, allowing a crafted repository to be placed in the community node directory. When the server restarts, the repository is loaded as a custom JavaScript node and can execute arbitrary code on the host, giving the attacker remote code execution.

Affected Systems

The bug affects the n8n workflow automation platform from n8n-io. Versions earlier than 1.123.64, 2.29.8, and 2.30.1 are vulnerable. The issue exists in all editions that include the Git clone node.

Risk and Exploitability

The CVSS score of 8.9 indicates high severity. No EPSS score is published, so the exploitation probability cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. Attackers need only an authenticated user with workflow creation rights who can use the Git clone node and then trigger a restart of the n8n instance; after the restart the malicious node loads and runs with the n8n process privileges, providing remote code execution.

Generated by OpenCVE AI on August 18, 2026 at 16:59 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade n8n to version 1.123.64, 2.29.8, or newer 2.30.1.
  • If an upgrade cannot be performed immediately, remove any untrusted directories from the community node folder to prevent malicious nodes from being loaded.
  • Restart n8n to ensure the vulnerable node is not loaded and verify that no custom JavaScript nodes from untrusted sources are present.

Generated by OpenCVE AI on August 18, 2026 at 16:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 18 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 18 Aug 2026 15:00:00 +0000

Type Values Removed Values Added
Description n8n is an open source workflow automation platform. Prior to 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user to swap a validated directory for a symlink before cloning, planting a crafted repository in the community node directory that loads as a custom JavaScript node after restart and executes arbitrary code on the server. This issue is fixed in versions 1.123.64, 2.29.8, and 2.30.1.
Title n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution
Weaknesses CWE-367
References
Metrics cvssV4_0

{'score': 8.9, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-18T18:02:36.878Z

Reserved: 2026-08-06T21:24:15.375Z

Link: CVE-2026-71539

cve-icon Vulnrichment

Updated: 2026-08-18T18:02:15.710Z

cve-icon NVD

Status : Received

Published: 2026-08-18T15:17:01.343

Modified: 2026-08-18T18:19:32.360

Link: CVE-2026-71539

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-18T17:00:12Z

Weaknesses
  • CWE-367

    Time-of-check Time-of-use (TOCTOU) Race Condition