A critical remote code execution vulnerability in n8n allows authenticated attackers to execute arbitrary code by manipulating Git repository pre-commit hooks.

This is a remote code execution flaw (CWE-829) located in the Git Node component. An attacker with low privileges can trigger the execution of arbitrary code within the n8n environment by forcing the platform to commit from a malicious repository containing a pre-commit hook.

The ability to execute arbitrary code within the n8n automation platform presents a severe risk to organizational security. Successful exploitation could lead to full system compromise, unauthorized access to sensitive workflows, and the exfiltration of credentials stored within connected third-party services. With a CVSS score of 8.8, this vulnerability is classified as High and requires immediate attention to prevent lateral movement and data theft.

Immediate Action: Update n8n instances to version 1.113.0 or later immediately to incorporate the necessary security fixes in the Git Node component.

Proactive Monitoring: Review n8n server logs for unusual Git operations, unexpected process spawns originating from the n8n service account, or unauthorized repository connections.

Compensating Controls: Restrict n8n Git access to known, trusted repositories and implement network egress filtering to prevent the platform from reaching unauthorized external Git servers.

Public Exploit Available: Yes, multiple public proofs-of-concept exist on GitHub.

Given the potential for full system compromise and the presence of public proof-of-concept code, this vulnerability poses a significant risk to your environment. Administrators should prioritize the update to version 1.113.0 across all self-hosted and cloud-managed n8n instances. Failure to patch may allow attackers to gain persistent access to your automation workflows and integrated credentials.