High · published December 9, 2025
🔥 A sneaky flaw in n8n's pre-commit hooks can pave the way for remote code execution! 😱 Think of it like a restaurant where the chefs can secretly change the recipes without the manager's knowledge. If a chef points the recipe book to a malicious version, they could serve up something hazardous to diners — your system could be at risk with each Git operation! An attacker with the ability to modify an n8n workflow could set a malicious Git hook that executes arbitrary commands on your host. This could lead to data breaches, unauthorized access, or even complete system compromise — an absolutely devastating scenario for your operations!
Think of it like a restaurant where the chefs can secretly change the recipes without the manager's knowledge. If a chef points the recipe book to a malicious version, they could serve up something hazardous to diners — your system could be at risk with each Git operation! This vulnerability allows the Add Config operation in n8n to set arbitrary Git configuration values, including core.hooksPath, which can lead to executing malicious commands hidden in Git hooks during workflows involving the Git node.
An attacker with the ability to modify an n8n workflow could set a malicious Git hook that executes arbitrary commands on your host. This could lead to data breaches, unauthorized access, or even complete system compromise — an absolutely devastating scenario for your operations! Upgrade your n8n instance to version 1.119.2 immediately to patch this critical vulnerability. Additionally, consider excluding the Git Node from workflows or avoiding interaction with untrusted repositories to minimize risk. Stay vigilant! You've got this! Follow these steps, and you'll have your n8n workflows secured in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| n8n/n8n | ≥ 0.123.1, < 1.119.2 | 1.119.2 |