https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 09:07:34 +0000 https://cve.radiocsirt.org/vuln/cve-2026-65598 <p><strong>Affected:</strong> n8n-io n8n</p> <p>n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node&#39;s clone operation that allows authenticated users to bypass path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This lets an attacker plant a crafted repository in the community node directory, which n8n loads as a custom node on the next restart, executing arbitrary JavaScript on the server. Both self-hosted and cloud instances are affected.</p> <p><strong>Affected:</strong> n8n-io n8n</p> <p>n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node&#39;s clone operation that allows authenticated users to bypass path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This lets an attacker plant a crafted repository in the community node directory, which n8n loads as a custom node on the next restart, executing arbitrary JavaScript on the server. Both self-hosted and cloud instances are affected.</p> https://cve.radiocsirt.org/vuln/cve-2026-65598