CVE-2026-65598: n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution
A TOCTOU race condition in the Git node’s clone operation lets an authenticated user bypass its path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This plants a crafted repository in the community node directory, which n8n loads as a custom node on the next restart, and since nodes execute JavaScript, this yields arbitrary code execution on the server.
Both self-hosted and cloud instances are affected, where authenticated users can create and run workflows using the Git node.
References
- github.com/advisories/GHSA-g3r5-9h93-4j2c
- github.com/n8n-io/n8n/releases/tag/n8n@1.123.64
- github.com/n8n-io/n8n/releases/tag/n8n@2.29.8
- github.com/n8n-io/n8n/releases/tag/n8n@2.30.1
- github.com/n8n-io/n8n/security/advisories/GHSA-g3r5-9h93-4j2c
- nvd.nist.gov/vuln/detail/CVE-2026-65598
- www.vulncheck.com/advisories/n8n-before-remote-code-execution-via-git-clone
Code Behaviors & Features
Detect and mitigate CVE-2026-65598 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →