CVE-2025-62726

Published Oct 30, 2025

Last updated 2 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-62726 is a remote code execution vulnerability affecting the Git Node component of n8n, an open-source workflow automation platform. This vulnerability exists in both Cloud and Self-Hosted versions of n8n prior to version 1.113.0. The vulnerability can be exploited if a malicious actor clones a remote repository containing a pre-commit hook. Subsequently, using the Commit operation in the Git Node can inadvertently trigger the execution of this hook. This could allow the attacker to execute arbitrary code within the n8n environment, potentially compromising the system.

Description: n8n is an open source workflow automation platform. Prior to 1.113.0, a remote code execution vulnerability exists in the Git Node component available in both Cloud and Self-Hosted versions of n8n. When a malicious actor clones a remote repository containing a pre-commit hook, the subsequent use of the Commit operation in the Git Node can inadvertently trigger the hook’s execution. This allows attackers to execute arbitrary code within the n8n environment, potentially compromising the system and any connected credentials or workflows. This vulnerability is fixed in 1.113.0.
Source: security-advisories@github.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

security-advisories@github.com: CWE-829

Hype score: Not currently trending

References