CVE-2025-62726 - CVE House
Back to Database
Status published High CVE-2025-62726

n8n Vulnerable to Remote Code Execution via Git Node Pre-Commit Hook

Vulnerability Description

n8n is an open source workflow automation platform. Prior to 1.113.0, a remote code execution vulnerability exists in the Git Node component available in both Cloud and Self-Hosted versions of n8n. When a malicious actor clones a remote repository containing a pre-commit hook, the subsequent use of the Commit operation in the Git Node can inadvertently trigger the hook’s execution. This allows attackers to execute arbitrary code within the n8n environment, potentially compromising the system and any connected credentials or workflows. This vulnerability is fixed in 1.113.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-62726

Credits & Attribution

No credits recorded in the NVD database.

References

More from n8n-io

View All →
CVE-2025-68949
n8n has a Webhook Node IP Whitelist Bypass via Partial String Matching
Medium 5.3
CVE-2025-68697
Self-hosted n8n has Legacy Code node that enables arbitrary file read/write
High 7.1
CVE-2025-68668
n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Node
Critical 9.9
CVE-2025-68613
n8n Vulnerable to Remote Code Execution via Expression Injection
Critical 10
CVE-2025-65964
n8n Vulnerable to Remote Code Execution via Git Node Custom Pre-Commit Hook
Critical 9.4

Affected Vendor

Affected Software

n8n
Vulnerable Versions:
< 1.113.0

Timeline

Official Publish: October 30th, 2025
Last Modified: October 31st, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-829

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.