CVE-2026-65598 | n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU ra… | CVSS 8.9 HIGH

Description

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This lets an attacker plant a crafted repository in the community node directory, which n8n loads as a custom node on the next restart, executing arbitrary JavaScript on the server. Both self-hosted and cloud instances are affected.

Metadata

CVE ID: CVE-2026-65598
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-07-22 10:45 UTC
Published: 2026-07-22 11:21 UTC
Last updated: 2026-07-22 12:22 UTC
Primary CWE: CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition
Vendor / Product: n8n-io / n8n
Sources: cve.org · NVD

Severity & Metrics

8.9 HIGH CVSS 4.0

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:L

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: total

Affected products (3)

Vendor	Product	Platform	Versions
n8n-io	n8n	—	0 < 1.123.64, 1.123.64
n8n-io	n8n	—	0 < 2.30.1, 2.30.1
n8n-io	n8n	—	0 < 2.29.8, 2.29.8

Weakness (CWE)

CWE	Source	Description
CWE-367	cna	Time-of-check Time-of-use (TOCTOU) Race Condition

CVSS scores (1)

Score	Severity	Version	Source	Vector
8.9	HIGH	4.0	cna	CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:L

References (2)

GitHub Security Advisory (GHSA-g3r5-9h93-4j2c) https://github.com/n8n-io/n8n/security/advisories/GHSA-g3r5-9h93-4j2c
VulnCheck Advisory: n8n before 1.123.64 Remote Code Execution via Git Clone https://www.vulncheck.com/advisories/n8n-before-remote-code-execution-via-git-clone