The vulnerability is a time-of-check to time-of-use (TOCTOU) race condition in n8n's Git node clone operation. Before versions 1.123.64, 2.29.8, and 2.30.1, an authenticated user can replace a validated directory with a symbolic link prior to cloning a repository. This manipulation allows the attacker to place a malicious repository in the community node directory. Upon restarting n8n, the malicious repository loads as a custom JavaScript node, resulting in arbitrary code execution on the server. The issue is fixed in the specified versions.

Successful exploitation results in arbitrary code execution on the server hosting n8n, compromising confidentiality, integrity, and availability of the system. The attacker must be an authenticated workflow user. The vulnerability has a CVSS 4.0 score of 8.9, indicating high severity with network attack vector, high impact on all security properties, and requiring low privileges but with high complexity and partial user interaction.

This vulnerability is fixed in n8n versions 1.123.64, 2.29.8, and 2.30.1. Users should upgrade to one of these versions or later to remediate the issue. No other remediation or temporary fixes are indicated. Patch status is confirmed by the vendor's versioning information in the description.