Alex Joseph
Automating workflows is incredibly powerful, but even the tools designed to streamline processes can sometimes harbor serious security risks. A significant vulnerability, identified as CVE-2025-65964, has been discovered in n8n, an popular open-source workflow automation platform. This flaw could allow attackers to execute malicious code on your system, posing a high risk to affected installations.
This vulnerability centers around how n8n versions prior to 1.119.2 handle Git operations, specifically through its ‘Add Config’ feature within the Git node. Without proper safeguards, an attacker who can create or modify an n8n workflow could manipulate Git settings to point to a malicious ‘pre-commit hook’. These hooks are scripts that run automatically during certain Git actions. If exploited, this could lead to Remote Code Execution (RCE), giving the attacker control over the n8n host system.
CVE Details
- Product: n8n
- Published: December 9, 2025
- Severity: High
- Status: Analyzed
Affected Products
This critical vulnerability impacts n8n versions from 0.123.1 up to and including 1.119.1. If you are running any of these versions, your system is at risk.
Current Status
As of the latest information, this vulnerability has been fully analyzed. Crucially, a fix has been released by the n8n development team to address this security loophole.
Severity Level
CVE-2025-65964 is classified as ‘High’ severity, with a CVSS score of 8.8. This high rating reflects the serious potential impact of a successful exploit. Remote Code Execution (RCE) means an attacker could run arbitrary commands on the server hosting n8n, leading to full system compromise, data theft, or further network penetration. The requirement to create or modify an n8n workflow with a Git node does somewhat narrow the attack surface, but for environments where users have such privileges, the danger is substantial.
Possible Solutions
Fortunately, there are clear steps you can take to protect your n8n instance from this vulnerability:
- Update Immediately: The most important step is to upgrade your n8n installation to version 1.119.2 or newer. This version includes the necessary patches to prevent the exploitation of this vulnerability.
- Exclude the Git Node: If upgrading immediately isn’t feasible, consider disabling or excluding the Git Node within your n8n environment. This can be done via configuration settings, effectively removing the attack vector. (Refer to n8n documentation for detailed instructions on excluding nodes).
- Exercise Caution with Untrusted Repositories: Avoid using the Git Node to clone or interact with untrusted Git repositories. This practice minimizes the chance of an attacker injecting malicious Git hooks into your workflows.
References
https://github.com/n8n-io/n8n/commit/d5a1171f95f75def5c3ac577707ab913e22aef04
https://github.com/n8n-io/n8n/releases/tag/n8n%401.119.2
https://github.com/n8n-io/n8n/security/advisories/GHSA-wpqc-h9wp-chmq
https://n8n-docs.teamlab.info/hosting/securing/blocking-nodes/#exclude-nodes
