{"cve":"CVE-2025-65964","nvd":{"published":"2025-12-09T00:15:48.800","modified":"2026-10-14T22:10:00.210","status":"Analyzed","description":"n8n is an open source workflow automation platform. Versions 0.123.1 through 1.119.1 do not have adequate protections to prevent RCE through the project's pre-commit hooks. The Add Config operation allows workflows to set arbitrary Git configuration values, including core.hooksPath, which can point to a malicious Git hook that executes arbitrary commands on the n8n host during subsequent Git operations. Exploitation requires the ability to create or modify an n8n workflow using the Git node. This issue is fixed in version 1.119.2. Workarounds include excluding the Git Node (Docs) and avoiding cloning or interacting with untrusted repositories using the Git Node.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","score":9.4},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8},"cwes":["CWE-829"],"references":["https://github.com/n8n-io/n8n/commit/d5a1171f95f75def5c3ac577707ab913e22aef04","https://github.com/n8n-io/n8n/releases/tag/n8n%401.119.2","https://github.com/n8n-io/n8n/security/advisories/GHSA-wpqc-h9wp-chmq","https://n8n-docs.teamlab.info/hosting/securing/blocking-nodes/#exclude-nodes"],"products":["n8n:n8n"],"source":"nvd","synced_at":"2026-10-19T22:16:40.427100871+00:00"},"epss":{"cve":"CVE-2025-65964","score":0.00663,"percentile":0.51415,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-wpqc-h9wp-chmq","url":"https://osv.dev/vulnerability/GHSA-wpqc-h9wp-chmq","summary":"n8n vulnerable to Remote Code Execution via Git Node Custom Pre-Commit Hook","modified":"2025-12-09T17:31:40.017214Z","packages":[{"ecosystem":"npm","name":"n8n","purl":"pkg:npm/n8n","ranges":[">=0.123.1 <1.119.2"],"fixed":["1.119.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}