n8n Vulnerable to Remote Code Execution via Git Node Custom Pre-Commit Hook

@@ -55,4 +55,10 @@ export class SecurityConfig {
 	/** Whether to allow access to AWS system credentials, e.g. in awsAssumeRole credentials */
 	@Env('N8N_AWS_SYSTEM_CREDENTIALS_ACCESS_ENABLED')
 	awsSystemCredentialsAccess: boolean = false;
+
+	/**
+	 * Whether to enable hooks (like pre-commit hooks) for the Git node.
+	 */
+	@Env('N8N_GIT_NODE_ENABLE_HOOKS')
+	enableGitNodeHooks: boolean = false;
 }

@@ -316,6 +316,7 @@ describe('GlobalConfig', () => {
 			disableWebhookHtmlSandboxing: false,
 			disableBareRepos: false,
 			awsSystemCredentialsAccess: false,
+			enableGitNodeHooks: false,
 		},
 		executions: {
 			mode: 'regular',

@@ -302,6 +302,11 @@ export class Git implements INodeType {
 					gitConfig.push('safe.bareRepository=explicit');
 				}
 
+				const enableHooks = securityConfig.enableGitNodeHooks;
+				if (!enableHooks) {
+					gitConfig.push('core.hooksPath=/dev/null');
+				}
+
 				const gitOptions: Partial<SimpleGitOptions> = {
 					baseDir: repositoryPath,
 					config: gitConfig,

@@ -30,6 +30,7 @@ describe('Git Node', () => {
 		});
 		securityConfig = mock<SecurityConfig>({
 			disableBareRepos: false,
+			enableGitNodeHooks: true,
 		});
 		Container.set(DeploymentConfig, deploymentConfig);
 		Container.set(SecurityConfig, securityConfig);
@@ -114,4 +115,30 @@ describe('Git Node', () => {
 			);
 		});
 	});
+
+	describe('Hooks Configuration', () => {
+		it('should add core.hooksPath=/dev/null when enableGitNodeHooks is false', async () => {
+			securityConfig.enableGitNodeHooks = false;
+
+			await gitNode.execute.call(executeFunctions);
+
+			expect(mockSimpleGit).toHaveBeenCalledWith(
+				expect.objectContaining({
+					config: ['core.hooksPath=/dev/null'],
+				}),
+			);
+		});
+
+		it('should not add core.hooksPath=/dev/null when enableGitNodeHooks is true', async () => {
+			securityConfig.enableGitNodeHooks = true;
+
+			await gitNode.execute.call(executeFunctions);
+
+			expect(mockSimpleGit).toHaveBeenCalledWith(
+				expect.objectContaining({
+					config: [],
+				}),
+			);
+		});
+	});
 });