n8n Git Node TOCTOU Race Condition Leading to Remote Code Execution
First seen Jul 22, 2026 · Updated Jul 22, 2026
This is a duplicate advisory (superseded by GHSA-g3r5-9h93-4j2c) describing a time-of-check-to-time-of-use flaw in n8n's Git node clone operation. Authenticated attackers could swap a validated directory for a symlink to plant a malicious repository that n8n loads as a custom node on restart, achieving arbitrary code execution on the host. While the vulnerability itself is genuine and impactful, this specific advisory record carries no new information since it has been withdrawn in favor of the canonical GHSA entry.
Technical Analysis
The vulnerability is a classic TOCTOU (time-of-check-to-time-of-use) race condition in the workflow automation tool n8n's Git node: the path validation step and the actual clone operation are not atomic, allowing an authenticated attacker to replace a checked directory with a symlink pointing to n8n's community node directory. The n8n agent/orchestration layer treats git-cloned content as a trusted plugin source, so once the malicious repository lands in the community node directory, it is loaded and executed as native JavaScript on the next service restart. This crosses a tool-boundary trust assumption: n8n's workflow engine implicitly trusts filesystem paths validated moments earlier, without re-verifying at execution time, letting a lower-privilege authenticated user escalate to full server-level code execution. Because n8n is often used to orchestrate agentic/LLM workflows and connect to other tools and APIs, compromise of the underlying host has downstream implications for any agent pipelines it drives.
Affected Systems
n8n
Detection Signatures
- Unexpected symlinks appearing in n8n community node directories
- Git clone operations followed by rapid filesystem path swaps (directory-to-symlink) before clone completion
- Unrecognized or unauthorized JavaScript files appearing in n8n custom node paths after service restart
- Audit logs showing authenticated low-privilege users invoking Git node clone operations with unusual target paths
Remediation Steps
- 1
Upgrade n8n
Update to n8n 1.123.64, 2.29.8, 2.30.1, or later, which contain the fix for this TOCTOU race condition.
- 2
Restrict Git node usage
Limit which authenticated users/roles can use the Git node clone functionality, especially in multi-tenant or shared instances.
- 3
Harden filesystem permissions
Ensure the community node directory and clone target paths are not writable by lower-privileged users, and disallow symlink creation where possible.
- 4
Monitor node directory integrity
Implement file integrity monitoring on the custom/community node directory to detect unauthorized additions or symlink swaps.
- 5
Reference canonical advisory
Track and apply fixes per GHSA-g3r5-9h93-4j2c, the non-duplicate advisory, for the authoritative patch and version guidance.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.