CyberRota Analysis
AI-GeneratedThe vulnerability affects the n8n open source workflow automation platform, specifically in versions prior to 1.123.64, 2.29.8, and 2.30.1, where an authenticated user can exploit the Git node clone operation to replace a validated directory with a symlink. This allows for the injection of a malicious repository that executes arbitrary JavaScript code on the server upon restart, posing a significant security risk. Organizations using affected versions should prioritize upgrading to the patched releases to mitigate the risk of unauthorized code execution.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
n8n is an open source workflow automation platform. Prior to 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user to swap a validated directory for a symlink before cloning, planting a crafted repository in the community node directory that loads as a custom JavaScript node after restart and executes arbitrary code on the server. This issue is fixed in versions 1.123.64, 2.29.8, and 2.30.1.