CVE-2026-71539
n8n is an open source workflow automation platform. Prior to 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user to swap a validated directory for a symlink before cloning, planting a crafted repository in the community node directory that loads as a custom JavaScript node after restart and executes arbitrary code on the server. This issue is fixed in versions 1.123.64, 2.29.8, and 2.30.1.
- CVSS 4.0
- 8.9
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:L - EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 23% of CVEs (scores of 2026-10-25)
- CWE
- CWE-367
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-g3r5-9h93-4j2c | npm | n8n | <1.123.64 | 1.123.64 |
| GHSA-g3r5-9h93-4j2c | npm | n8n | >=2.30.0 <2.30.1 | 2.30.1 |
| GHSA-g3r5-9h93-4j2c | npm | n8n | >=2.0.0-rc.0 <2.29.8 | 2.29.8 |