AI description
CVE-2025-65964 affects n8n, an open-source workflow automation platform, specifically versions 0.123.1 through 1.119.1. The vulnerability lies in the Git node, where the "Add Config" operation permits setting arbitrary Git configuration values. By manipulating the `core.hooksPath` setting, an attacker can point Git to a malicious directory containing Git hooks (e.g., pre-commit). When a workflow controlled by an attacker sets the `core.hooksPath` to a directory with a malicious Git hook, that hook will be executed during subsequent Git operations. Because Git hooks are executed as local system commands, this can lead to arbitrary command execution on the n8n host. Exploitation requires the ability to create or modify an n8n workflow that uses the Git node. Version 1.119.2 addresses this vulnerability.
- Description
- n8n is an open source workflow automation platform. Versions 0.123.1 through 1.119.1 do not have adequate protections to prevent RCE through the project's pre-commit hooks. The Add Config operation allows workflows to set arbitrary Git configuration values, including core.hooksPath, which can point to a malicious Git hook that executes arbitrary commands on the n8n host during subsequent Git operations. Exploitation requires the ability to create or modify an n8n workflow using the Git node. This issue is fixed in version 1.119.2. Workarounds include excluding the Git Node (Docs) and avoiding cloning or interacting with untrusted repositories using the Git Node.
- Source
- security-advisories@github.com
- NVD status
- Analyzed
- Products
- n8n
CVSS 4.0
- Type
- Secondary
- Base score
- 9.4
- Impact score
- -
- Exploitability score
- -
- Vector string
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity
- CRITICAL
CVSS 3.1
- Type
- Primary
- Base score
- 8.8
- Impact score
- 5.9
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
- security-advisories@github.com
- CWE-829
- Hype score
- Not currently trending
🚨 New plugin: N8nPlugin (CVE-2025-68613, CVE-2025-65964, CVE-2025-62726). n8n Workflow Automation multiple vulnerabilities detection. Results: https://t.co/GvJen2HstB https://t.co/rDYWed4haO
@leak_ix
26 Dec 2025
2109 Impressions
4 Retweets
14 Likes
7 Bookmarks
1 Reply
0 Quotes
ワークフロー自動化ツールn8nに重大(Critical)な脆弱性。CVE-2025-65964はCVSSスコア9.4の任意コード実行。GitノードでのGit統合に影響し、Gitの構成に細工を加えることでホスト上でコードを実行可能。バージョン1.119.
@__kokumoto
10 Dec 2025
2580 Impressions
13 Retweets
37 Likes
18 Bookmarks
0 Replies
0 Quotes
🚨🚨CVE-2025-65964 (CVSS 9.4): Git Node RCE in n8n n8n's Git node lets workflows set arbitrary Git config, including core.hooksPath → point it at a malicious hook in the repo → instant RCE on the host. Search by vul.cve Filter👉vul.cve="CVE-2025-65964" ZoomEye Dork👉
@zoomeye_team
10 Dec 2025
21999 Impressions
51 Retweets
280 Likes
155 Bookmarks
4 Replies
4 Quotes
🚨 CRITICAL n8n-io n8n vuln (CVE-2025-65964): RCE risk in versions 0.123.1–1.119.1 via malicious Git hooks! Upgrade to 1.119.2 ASAP. Disable Git node if you can’t patch. https://t.co/IVKQWtZQQ7 #OffSeq #n8n #Cy... https://t.co/dMb12WFQWU
@offseq
9 Dec 2025
2 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2025-65964 n8n is an open source workflow automation platform. Versions 0.123.1 through 1.119.1 do not have adequate protections to prevent RCE through the project's pre-commit … https://t.co/oMBOi20OH9
@CVEnew
8 Dec 2025
177 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*",
"vulnerable": true,
"matchCriteriaId": "6D50DACE-8293-4E05-974C-6F971563D06F",
"versionEndExcluding": "1.119.2",
"versionStartIncluding": "0.123.1"
}
],
"operator": "OR"
}
]
}
]