CVE-2025-65964
HIGHn8n 0.123.1-1.119.1 - Remote Code Execution via Git Hook Path Manipulation
Title source: llmExploitation Summary
EIP tracks 6 public exploits for CVE-2025-65964. PoCs published by Syzygy-K, nn0nkey, Pinus97.
AI-analyzed exploit summary This PoC exploits CVE-2025-65964 in n8n by manipulating Git hooks to achieve remote code execution. It demonstrates how an attacker can clone a malicious repository, modify Git configurations, and trigger arbitrary command execution via a crafted pre-commit hook.
Description
n8n is an open source workflow automation platform. Versions 0.123.1 through 1.119.1 do not have adequate protections to prevent RCE through the project's pre-commit hooks. The Add Config operation allows workflows to set arbitrary Git configuration values, including core.hooksPath, which can point to a malicious Git hook that executes arbitrary commands on the n8n host during subsequent Git operations. Exploitation requires the ability to create or modify an n8n workflow using the Git node. This issue is fixed in version 1.119.2. Workarounds include excluding the Git Node (Docs) and avoiding cloning or interacting with untrusted repositories using the Git Node.
Exploits (6)
This PoC exploits CVE-2025-65964 in n8n by manipulating Git hooks to achieve remote code execution. It demonstrates how an attacker can clone a malicious repository, modify Git configurations, and trigger arbitrary command execution via a crafted pre-commit hook.
The repository contains only a README.md file with a title claiming to be a 'Malicious Repo for CVE-2025-65964' but no actual exploit code or technical details. This appears to be a placeholder or stub.
This repository is a CTF demonstration explaining how Git hooks can be misused via `core.hooksPath` to achieve command execution in an automation platform like n8n. It describes a scenario where an attacker-controlled workflow sets a malicious Git configuration to execute hooks from a repository directory.
The repository contains only a README.md file with minimal information, lacking any actual exploit code or technical details. It appears to be a placeholder or incomplete submission.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H