Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-c232-fvfd-3fda
Vulnerability ID VCID-c232-fvfd-3fda
Aliases CVE-2025-65964
GHSA-wpqc-h9wp-chmq
Summary n8n is an open source workflow automation platform. Versions 0.123.1 through 1.119.1 do not have adequate protections to prevent RCE through the project's pre-commit hooks. The Add Config operation allows workflows to set arbitrary Git configuration values, including core.hooksPath, which can point to a malicious Git hook that executes arbitrary commands on the n8n host during subsequent Git operations. Exploitation requires the ability to create or modify an n8n workflow using the Git node. This issue is fixed in version 1.119.2. Workarounds include excluding the Git Node (Docs) and avoiding cloning or interacting with untrusted repositories using the Git Node.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-829 Inclusion of Functionality from Untrusted Control Sphere
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00033 https://api.first.org/data/v1/epss?cve=CVE-2025-65964
epss 0.00033 https://api.first.org/data/v1/epss?cve=CVE-2025-65964
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-wpqc-h9wp-chmq
cvssv4 9.4 https://github.com/n8n-io/n8n
generic_textual CRITICAL https://github.com/n8n-io/n8n
cvssv4 9.4 https://github.com/n8n-io/n8n/commit/d5a1171f95f75def5c3ac577707ab913e22aef04
generic_textual CRITICAL https://github.com/n8n-io/n8n/commit/d5a1171f95f75def5c3ac577707ab913e22aef04
ssvc Track https://github.com/n8n-io/n8n/commit/d5a1171f95f75def5c3ac577707ab913e22aef04
cvssv4 9.4 https://github.com/n8n-io/n8n/releases/tag/n8n%401.119.2
generic_textual CRITICAL https://github.com/n8n-io/n8n/releases/tag/n8n%401.119.2
ssvc Track https://github.com/n8n-io/n8n/releases/tag/n8n%401.119.2
cvssv3.1_qr CRITICAL https://github.com/n8n-io/n8n/security/advisories/GHSA-wpqc-h9wp-chmq
cvssv4 9.4 https://github.com/n8n-io/n8n/security/advisories/GHSA-wpqc-h9wp-chmq
generic_textual CRITICAL https://github.com/n8n-io/n8n/security/advisories/GHSA-wpqc-h9wp-chmq
ssvc Track https://github.com/n8n-io/n8n/security/advisories/GHSA-wpqc-h9wp-chmq
cvssv4 9.4 https://n8n-docs.teamlab.info/hosting/securing/blocking-nodes/#exclude-nodes
generic_textual CRITICAL https://n8n-docs.teamlab.info/hosting/securing/blocking-nodes/#exclude-nodes
ssvc Track https://n8n-docs.teamlab.info/hosting/securing/blocking-nodes/#exclude-nodes
cvssv4 9.4 https://nvd.nist.gov/vuln/detail/CVE-2025-65964
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2025-65964
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2025-65964
https://github.com/n8n-io/n8n
CVE-2025-65964 https://nvd.nist.gov/vuln/detail/CVE-2025-65964
d5a1171f95f75def5c3ac577707ab913e22aef04 https://github.com/n8n-io/n8n/commit/d5a1171f95f75def5c3ac577707ab913e22aef04
#exclude-nodes https://n8n-docs.teamlab.info/hosting/securing/blocking-nodes/#exclude-nodes
GHSA-wpqc-h9wp-chmq https://github.com/advisories/GHSA-wpqc-h9wp-chmq
GHSA-wpqc-h9wp-chmq https://github.com/n8n-io/n8n/security/advisories/GHSA-wpqc-h9wp-chmq
n8n%401.119.2 https://github.com/n8n-io/n8n/releases/tag/n8n%401.119.2
No exploits are available.
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H Found at https://github.com/n8n-io/n8n
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H Found at https://github.com/n8n-io/n8n/commit/d5a1171f95f75def5c3ac577707ab913e22aef04
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-12-09T14:18:38Z/ Found at https://github.com/n8n-io/n8n/commit/d5a1171f95f75def5c3ac577707ab913e22aef04
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H Found at https://github.com/n8n-io/n8n/releases/tag/n8n%401.119.2
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-12-09T14:18:38Z/ Found at https://github.com/n8n-io/n8n/releases/tag/n8n%401.119.2
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H Found at https://github.com/n8n-io/n8n/security/advisories/GHSA-wpqc-h9wp-chmq
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-12-09T14:18:38Z/ Found at https://github.com/n8n-io/n8n/security/advisories/GHSA-wpqc-h9wp-chmq
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H Found at https://n8n-docs.teamlab.info/hosting/securing/blocking-nodes/#exclude-nodes
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-12-09T14:18:38Z/ Found at https://n8n-docs.teamlab.info/hosting/securing/blocking-nodes/#exclude-nodes
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H Found at https://nvd.nist.gov/vuln/detail/CVE-2025-65964
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.1024
EPSS Score 0.00033
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:57:39.001304+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2025/65xxx/CVE-2025-65964.json 38.6.0