Remote Code Execution Vulnerability in n8n Workflow Automation Platform
CVE-2025-62726

8.8HIGH

Key Information:

Vendor

N8n-io

Status
N8n
Vendor
CVE Published:
30 October 2025

What is CVE-2025-62726?

n8n, an open-source workflow automation platform, has a remote code execution vulnerability in the Git Node component prior to version 1.113.0. When a malicious actor successfully clones a remote repository that includes a pre-commit hook, executing the Commit operation in the Git Node can lead to the unexpected execution of the hook. This could allow attackers to run arbitrary code within the n8n environment, putting the system and any associated credentials or workflows at risk. This vulnerability was addressed and is no longer an issue in version 1.113.0.

Affected Version(s)

n8n < 1.113.0

References

https://github.com/n8n-io/n8n/security/advisories/GHSA-xg...
x_refsource_CONFIRM
https://github.com/n8n-io/n8n/pull/19559
x_refsource_MISC
https://github.com/n8n-io/n8n/commit/5bf3db5ba84d3195bbe1...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-62726 : Remote Code Execution Vulnerability in n8n Workflow Automation Platform