TOCTOU Race Condition in n8n Git Node's Clone Operation

CVE-2026-65598

What is CVE-2026-65598?

An identified vulnerability in n8n affects its Git node's clone operation, where a TOCTOU (Time of Check to Time of Use) race condition allows authenticated users to exploit path validation mechanisms. By swapping a target directory with a symbolic link right after validation, an attacker can introduce a malicious repository into the community node directory. This manipulated repository is then loaded as a custom node during the next server restart, leading to the execution of arbitrary JavaScript code on both self-hosted and cloud instances.

References