All vulnerabilities

Servers and applications

CVE-2025-65964

n8n is an open source workflow automation platform. Versions 0.123.1 through 1.119.1 do not have adequate protections to prevent RCE through the project's pre-commit hooks. The Add Config operation allows workflows to set arbitrary Git configuration values, including core.hooksPath, which can point to a malicious Git hook that executes arbitrary commands on the n8n host during subsequent Git…

Severity
Critical 9.4
Published
9 Dec 2025
Last changed
14 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.119.2
Sources
NVD

Affected software

SoftwareAffected versions
n8nServers and applications · cpe:a:n8n:n8n
  • From 0.123.1 before 1.119.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-65964
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-65964