CVE-2026-65598: n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution

A TOCTOU race condition in the Git node’s clone operation lets an authenticated user bypass its path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This plants a crafted repository in the community node directory, which n8n loads as a custom node on the next restart, and since nodes execute JavaScript, this yields arbitrary code execution on the server.

Both self-hosted and cloud instances are affected, where authenticated users can create and run workflows using the Git node.