n8n Git Node TOCTOU Race Condition Leading to Remote Code Execution
First seen Jul 22, 2026 · Updated Jul 22, 2026
A time-of-check-to-time-of-use (TOCTOU) flaw in n8n's Git node lets an authenticated user swap a validated directory for a symlink right before the clone operation executes, planting a malicious repository into the custom node directory. Because n8n loads custom nodes as executable JavaScript on restart, this results in full remote code execution on the server. Both self-hosted and cloud n8n instances are affected wherever the Git node is usable by workflow authors.
Technical Analysis
The Git node's clone operation validates a target path and then performs the clone, but an attacker with workflow-authoring privileges can race this window by replacing the validated directory with a symlink pointing into n8n's community node loading directory. This bypasses the intended path restriction and drops attacker-controlled files into a location n8n treats as trusted extension code. On the next instance restart, n8n auto-loads the planted package as a node, executing arbitrary JavaScript with the privileges of the n8n process — turning workflow-level access into host-level code execution. The entry point is the workflow orchestration/tool layer (a built-in 'agent tool' node), and the impact crosses from a single automation workflow into full server compromise, affecting any other workflows, credentials, and downstream integrations managed by that instance.
Affected Systems
n8n
Detection Signatures
- Unexpected symlinks appearing in n8n's custom/community node directories
- Git node clone operations targeting paths outside expected workflow directories
- n8n restart events shortly followed by new/unfamiliar community node registrations
- Workflow execution logs showing rapid repeated Git node clone attempts (race condition probing)
- NODES_EXCLUDE bypass attempts or unauthorized modification of node loading configuration
Remediation Steps
- 1
Upgrade n8n
Update to the patched n8n version (>=1.123.64, or the fixed 2.x releases) as soon as it is available.
- 2
Restrict Git node usage
Add n8n-nodes-base.git to NODES_EXCLUDE to disable the vulnerable node until patched.
- 3
Limit trusted users
Restrict n8n instance and workflow-authoring access to fully trusted, vetted users only.
- 4
Restrict egress
Limit network egress from the n8n server to prevent cloning from attacker-controlled git repositories.
- 5
Audit node directory
Regularly audit the community/custom node directory for unexpected symlinks or unfamiliar packages and monitor restarts for newly loaded nodes.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.