CVE-2026-71539: n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution
n8n is an open source workflow automation platform. Prior to 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user to swap a validated directory for a symlink before cloning, planting a crafted repository in the community node directory that loads as a custom JavaScript node after restart and executes arbitrary code on the server. This issue is fixed in versions 1.123.64, 2.29.8, and 2.30.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8n Git nodeto a version that resolves this vulnerability.Fixed in 1.123.64 - Upgrade
Upgrade
n8n Git nodeto a version that resolves this vulnerability.Fixed in 2.29.8 - Upgrade
Upgrade
n8n Git nodeto a version that resolves this vulnerability.Fixed in 2.30.1
Event History
Frequently Asked Questions
Which users can exploit this issue, and what is the impact?
Authenticated workflow users who can use the Git node's clone operation are the relevant threat population. Successful exploitation can result in arbitrary code execution on the n8n server after it is restarted.
What does an attacker need to do to exploit the race condition?
The attacker must win a race to replace a directory that has already been validated with a symlink during a Git clone operation, then plant a crafted repository in the community node directory. The planted content is loaded as a custom JavaScript node after restart.
Which versions remediate the vulnerability?
Upgrade n8n to 1.123.64, 2.29.8, or 2.30.1, depending on the release line in use. These versions contain the fix.