External risk intelligence

n8n Workflow Automation RCE via Git Hooks.

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2025-65964

n8n is a workflow automation platform frequently deployed as a web-based application or service to orchestrate external integrations and APIs. While the specific vulnerability requires access to the Git node functionality, the product itself is commonly deployed as an internet-facing service or internal application portal, placing the underlying interface within the common network reach of users and external services.

N8n

0.123.1 to before 1.119.2

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the n8n workflow automation platform allows for the execution of arbitrary commands on the host system if a user can modify workflows using the Git node. This could potentially lead to unauthorized access and control of the affected n8n instance.

Workflow tool has a critical command execution flaw.
Protects automation, integration, and orchestration systems.
Confirm if Git node use requires immediate review.

Attack Path

How an attacker could exploit the issue

An attacker with the ability to modify or create workflows can exploit this vulnerability. By manipulating the Git node's configuration, they can redirect Git operations to a malicious script, which then runs on the n8n host. This could potentially lead to arbitrary command execution on the server.

Requires workflow creation/modification access.
Triggered by Git node configuration changes.
Risk of arbitrary command execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker with the ability to modify n8n workflows to execute arbitrary commands on the n8n host. This occurs when the Git node is used to set a malicious Git hook, which then runs during subsequent Git operations.

Arbitrary code execution on host.
Malicious Git hook via workflow modification.
Compromised host and system integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for n8n instances, likely platform or application owners, must first identify deployments, confirm reachability and criticality, and then assign an owner for remediation planning. The ability to create or modify n8n workflows using the Git node is required for exploitation, enabling the execution of arbitrary commands on the n8n host.

Confirm n8n instance reachability and criticality.
Identify workflow automation platform owners.
Plan remediation or implement workarounds.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is n8n and what is it used for?

n8n is an open-source workflow automation platform designed to connect various services, APIs, and tools. Users build visual workflows that orchestrate data transfers and business processes across their infrastructure. It acts as an integration engine, often hosted on a server to manage complex, automated tasks between different software applications.

How does CVE-2025-65964 allow code execution?

This vulnerability is classified as Inclusion of Functionality from Untrusted Control Sphere (CWE-829). It occurs because the Git node in n8n permits setting arbitrary Git configuration values. An attacker can set the core.hooksPath to a malicious location, which forces the n8n host to run unauthorized commands when it performs subsequent Git operations.

Do I need to be a system administrator to trigger this bug?

No, you do not need administrative privileges to trigger this, but you do need the ability to create or modify workflows using the Git node. If you cannot configure a Git node within an n8n workflow, this path is not accessible to you. Simply viewing workflows or interacting with other, non-Git-related nodes does not initiate the flaw.

Is my n8n instance at risk based on Halo Surface Signal?

Halo Surface Signal indicates that because n8n is often deployed as a web-based service for orchestration, it is frequently reachable from internal or external networks. If your instance is exposed to the internet or accessible to users with workflow-editing permissions, the risk is higher, as an attacker would only need to manipulate the Git node configuration to compromise the host.

How should I respond to this vulnerability?

First, update your n8n installation to version 1.119.2 or later to resolve the issue. If you cannot update immediately, you can mitigate the risk by excluding the Git node from your n8n deployment entirely. Additionally, you should avoid using the Git node to clone or interact with repositories that you do not fully trust.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.