High · published October 30, 2025
⚡ A crafty pre-commit hook in a cloned Git repository could spell disaster for your n8n setup! 🚨 Think of it like letting a delivery driver into your office to drop off a package, only to discover they’ve sneaked in a suspicious package that activates a hidden trap. In this case, the Git Node component executes unwanted code just because it was triggered by a seemingly innocent commit. An attacker could potentially take control of your n8n environment, executing arbitrary code that compromises the entire system, including any connected credentials or workflows. This can lead to data theft, unauthorized access, or even a complete takeover of the automation system—absolutely devastating!
Think of it like letting a delivery driver into your office to drop off a package, only to discover they’ve sneaked in a suspicious package that activates a hidden trap. In this case, the Git Node component executes unwanted code just because it was triggered by a seemingly innocent commit. This vulnerability allows remote code execution within n8n when a pre-commit hook from a cloned repository is triggered during Git operations, effectively bypassing normal security checks and running harmful code.
An attacker could potentially take control of your n8n environment, executing arbitrary code that compromises the entire system, including any connected credentials or workflows. This can lead to data theft, unauthorized access, or even a complete takeover of the automation system—absolutely devastating! Update your n8n instance to version 1.113.0 immediately to close this vulnerability. If you're using the Git Node, review your repositories and disallow any suspicious hooks from executing. Always ensure your workflow components are up to date and audited for security! You've got this! Just follow these steps, and you’ll be back to automating workflows in a secure environment in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| n8n/n8n | < 1.113.0 | 1.113.0 |