Alex Joseph
Understanding the High-Severity n8n RCE Vulnerability (CVE-2025-62726)
n8n, an open-source platform designed for workflow automation, has recently addressed a critical security flaw. This vulnerability, identified as CVE-2025-62726, poses a significant risk due to its potential for remote code execution (RCE). It’s important for all users, whether operating n8n in the cloud or through a self-hosted setup, to understand this issue and take appropriate steps.
The core of the problem lies within the Git Node component of n8n. Specifically, if a malicious actor is able to clone a remote Git repository that contains a specially crafted “pre-commit hook,” and a legitimate n8n workflow then performs a “Commit” operation using the Git Node, this hook can be triggered. When activated, the malicious pre-commit hook can execute arbitrary code within the n8n environment. This could potentially lead to a complete compromise of the n8n system, including access to connected credentials and sensitive workflow data.
CVE Details
- Product: n8n
- Published: October 30, 2025
- Severity: High
- Status: Analyzed
Affected Products
This vulnerability impacts n8n versions that are older than 1.113.0. Both cloud-based and self-hosted instances of n8n are susceptible if they are running a vulnerable version.
Current Status
The vulnerability has been officially analyzed and acknowledged by the n8n development team. A fix has been released, and users are strongly encouraged to update their installations.
Severity Level
CVE-2025-62726 is rated with a HIGH severity, carrying a CVSS score of 8.8. This high rating reflects the significant danger associated with remote code execution. An attacker exploiting this vulnerability could gain full control over the n8n instance, allowing them to access, modify, or delete data, disrupt operations, or even pivot to other systems within the network. Such a compromise could have severe consequences, including data breaches, operational downtime, and reputational damage.
Possible Solutions
The most crucial step to protect your n8n installation from CVE-2025-62726 is to update to version 1.113.0 or later immediately. The n8n team has addressed this vulnerability in the mentioned version.
For cloud versions of n8n, support for bare repositories in the Git Node has been removed entirely as a security measure. For self-hosted users, in addition to updating, it is highly recommended to disable bare repositories by setting the environment variable N8N_GIT_NODE_DISABLE_BARE_REPOS to true. This additional layer of defense helps mitigate the risk even further if your workflows do not specifically require bare Git repositories.
References
https://github.com/n8n-io/n8n/commit/5bf3db5ba84d3195bbe11bbd3c62f7086e090997
https://github.com/n8n-io/n8n/pull/19559
https://github.com/n8n-io/n8n/security/advisories/GHSA-xgp7-7qjq-vg47
