A TOCTOU race in n8n Git node clone lets an authenticated workflow user swap a validated directory for a symlink before clone, writing a crafted repo into the community node directory; after restart it loads as a custom JavaScript node and executes code on the server. Affected: < 1.123.64, >= 2.29.8 < 2.29.8, >= 2.30.1 < 2.30.1. Upgrade to 1.123.64, 2.29.8, or 2.30.1.