CVE-2025-62726

HIGH LAB

n8n < 1.113.0 - Remote Code Execution via Git Node Pre-Commit Hook

Title source: llm

Exploitation Summary

EIP tracks 3 public exploits for CVE-2025-62726. PoCs published by adminlove520, baktistr, Muzyli.

AI-analyzed exploit summary This repository contains a functional PoC for CVE-2025-62726, demonstrating RCE in n8n via malicious Git pre-commit hooks. It includes a Docker setup for a vulnerable n8n instance and a workflow to trigger the exploit.

Description

n8n is an open source workflow automation platform. Prior to 1.113.0, a remote code execution vulnerability exists in the Git Node component available in both Cloud and Self-Hosted versions of n8n. When a malicious actor clones a remote repository containing a pre-commit hook, the subsequent use of the Commit operation in the Git Node can inadvertently trigger the hook’s execution. This allows attackers to execute arbitrary code within the n8n environment, potentially compromising the system and any connected credentials or workflows. This vulnerability is fixed in 1.113.0.

Exploits (3)

github WORKING POC 2 stars

by adminlove520 · pythonpoc

https://github.com/adminlove520/CVE-Poc_All_in_One/tree/main/2025/CVE-2025-62726

View Code ZIP pw:eip

This repository contains a functional PoC for CVE-2025-62726, demonstrating RCE in n8n via malicious Git pre-commit hooks. It includes a Docker setup for a vulnerable n8n instance and a workflow to trigger the exploit.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: n8n < 1.113.0

Auth required

Prerequisites: Docker environment · n8n instance with Git Node enabled · ability to clone a malicious repository

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter T1203 - Exploitation for Client Execution

devstral-2 · analyzed Feb 27, 2026 Full analysis →

nomisec WORKING POC

by baktistr · poc

https://github.com/baktistr/cve-2025-62726-poc

View Code ZIP pw:eip

This PoC demonstrates a Remote Code Execution (RCE) vulnerability in n8n's Git Node via malicious Git pre-commit hooks. The exploit leverages the automatic execution of untrusted Git hooks during commit operations to achieve arbitrary code execution.