CVE-2026-65598

Analyzed Analyzed - Analysis Complete

TOCTOU Race Condition in n8n Git Node Allows Arbitrary Code Execution

Publication date: 2026-07-22

Last updated on: 2026-07-27

Assigner: VulnCheck

Description

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This lets an attacker plant a crafted repository in the community node directory, which n8n loads as a custom node on the next restart, executing arbitrary JavaScript on the server. Both self-hosted and cloud instances are affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-22

Last Modified

2026-07-27

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-10

NVD

CVE-2026-65598

EUVD

EUVD-2026-47642

Affected Vendors & Products

Vendor	Product	Version / Range
n8n	n8n	to 1.123.64 (exc)
n8n	n8n	From 2.0.0 (inc) to 2.29.8 (exc)
n8n	n8n	to 1.123.64 (exc)
n8n	n8n	From 2.0.0 (inc) to 2.29.8 (exc)
n8n	n8n	2.30.0
n8n	n8n	2.30.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-367	The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

Executive Summary

CVE-2026-65598 is a high-severity Remote Code Execution (RCE) flaw in n8n versions before 1.123.64, 2.29.8, and 2.30.1. It involves a Time-of-check Time-of-use (TOCTOU) race condition in the Git node's clone operation. Authenticated users can exploit this by replacing a directory with a symlink after path validation but before the clone executes. This allows planting a malicious repository in the community node directory, which n8n loads as a custom node on restart, enabling arbitrary JavaScript execution on the server.

Detection Guidance

Detecting this vulnerability requires checking the n8n version installed on your system. Run 'n8n --version' or check the package.json file in your n8n installation directory. If the version is below 1.123.64, 2.29.8, or 2.30.1, the system is vulnerable.

Impact Analysis

This vulnerability allows authenticated users to execute arbitrary JavaScript code on the server. It can lead to full system compromise, data theft, unauthorized access, or disruption of services. Both self-hosted and cloud instances are affected if authenticated users can create and run workflows using the Git node.

Compliance Impact

This vulnerability can severely impact compliance with GDPR, HIPAA, and other regulations by enabling unauthorized data access, modification, or exfiltration. It compromises confidentiality, integrity, and availability of sensitive data, potentially leading to legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade n8n to version 1.123.64, 2.29.8, or 2.30.1 or later immediately to patch the vulnerability.
Restrict instance access to trusted users only to prevent exploitation by unauthorized individuals.
Disable the Git node by setting the environment variable NODES_EXCLUDE to include 'Git'.
Limit network egress to prevent connections to untrusted or attacker-controlled repositories.

Hi! I’m here to help you understand CVE-2026-65598. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70