CVE-2025-62726

    Dashboard / Vulnerabilities / CVE-2025-62726

    CVE-2025-62726

    Published: 30 Oct 2025Last Modified: 12 Aug 2026

    Summary: n8n Vulnerable to Remote Code Execution via Git Node Pre-Commit Hook

    Details: n8n is an open source workflow automation platform. Prior to 1.113.0, a remote code execution vulnerability exists in the Git Node component available in both Cloud and Self-Hosted versions of n8n. When a malicious actor clones a remote repository containing a pre-commit hook, the subsequent use of the Commit operation in the Git Node can inadvertently trigger the hook’s execution. This allows attackers to execute arbitrary code within the n8n environment, potentially compromising the system and any connected credentials or workflows. This vulnerability is fixed in 1.113.0.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62726.json, https://github.com/n8n-io/n8n/security/advisories/GHSA-xgp7-7qjq-vg47, https://nvd.nist.gov/vuln/detail/CVE-2025-62726, https://github.com/n8n-io/n8n/commit/5bf3db5ba84d3195bbe11bbd3c62f7086e090997, https://github.com/n8n-io/n8n/pull/19559

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -2a0e38a8dc94203ed94b35d3536da321bb9f216d

    Affected versions

    [email protected]

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2025-62726 | CVE-DB