Summaryinfo

A vulnerability, which was classified as very critical, has been found in n8n up to 1.119.1. The affected element is the function core.hooksPath. This manipulation causes inclusion of functionality from untrusted control sphere. This vulnerability is tracked as CVE-2025-65964. The attack is possible to be carried out remotely. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in n8n up to 1.119.1. It has been declared as very critical. Affected by this vulnerability is the function core.hooksPath. The manipulation with an unknown input leads to a inclusion of functionality from untrusted control sphere vulnerability. The CWE definition for the vulnerability is CWE-829. The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

n8n is an open source workflow automation platform. Versions 0.123.1 through 1.119.1 do not have adequate protections to prevent RCE through the project's pre-commit hooks. The Add Config operation allows workflows to set arbitrary Git configuration values, including core.hooksPath, which can point to a malicious Git hook that executes arbitrary commands on the n8n host during subsequent Git operations. Exploitation requires the ability to create or modify an n8n workflow using the Git node. This issue is fixed in version 1.119.2. Workarounds include excluding the Git Node (Docs) and avoiding cloning or interacting with untrusted repositories using the Git Node.

The advisory is shared at github.com. This vulnerability is known as CVE-2025-65964 since 11/18/2025. The exploitation appears to be easy. The attack can be launched remotely. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 01/03/2026).

Upgrading to version 1.119.2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch d5a1171f95f75def5c3ac577707ab913e22aef04 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at CNNVD (CNNVD-202512-1080). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• n8n

Version

• 1.119.0
• 1.119.1

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion