Critical n8n RCE Flaw (CVE-2025-65964) Allows Remote Code Execution via Git Node Configuration Manipulation

A critical RCE vulnerability has been disclosed in n8n (CVE-2025-65964), which affects the Git node used to interact with version control within automation workflows. The flaw allows attackers to execute arbitrary code on the host by weaponising the platform’s Git integration, with a CVSS score of 9.4. The issue stems from a feature that lets workflows set arbitrary Git configuration values through the Add Config operation, enabling manipulation of core[.]hooksPath to direct Git to a malicious directory.

According to the security advisory, when an attacker-controlled workflow sets core[.]hooksPath to a directory in the cloned repository containing a Git hook such as pre-commit, Git executes that hook during subsequent Git operations, potentially leading to arbitrary command execution on the n8n host. The vulnerability affects n8n versions ≥ 0.123.1 and < 1.119.2, and a fix has been released in version 1.119.2. Mitigations for now include excluding the Git node or avoiding cloning or interacting with untrusted repositories using the Git Node.