Prototype pollution in n8n GSuiteAdmin node chains to remote code execution via Git node

The root cause is a classic prototype pollution pattern: the GSuiteAdmin node takes a user-supplied schema name from workflow configuration and uses it directly as a property key on a plain object. When that schema name is "__proto__", the nullish coalescing assignment is a no-op because the __proto__ getter returns Object.prototype, which is not nullish. The subsequent assignment then writes an attacker-controlled field name and value directly onto Object.prototype, and every plain object created afterwards inherits the polluted property. The attacker only needs editor access to the workflow configuration to control all three values: schema name, field name, and value.

The pollution chains into RCE through a multi-step gadget. The Git node uses simple-git, which allocates a plain object to hold environment variables; that object inherits from the now-polluted Object.prototype. When Node.js spawn() builds the child process environment, it iterates inherited properties, so the polluted GIT_SSH_COMMAND propagates into the git child process. When git encounters an SSH-style URL, it spawns GIT_SSH_COMMAND as a shell command, executing the attacker's payload as the n8n process user. The full chain is Webhook to GSuiteAdmin for pollution, then Git for code execution, triggered by a single HTTP POST request.

The pollution is independently destructive even without the RCE chain. After Object.prototype is polluted, TypeORM's buildWhere function picks up the extra properties through for...in iteration and throws EntityPropertyNotFoundError on every database query. The n8n UI goes unresponsive, all workflow executions fail, and the instance requires a full restart to recover. This means an attacker who can reach the GSuiteAdmin node can cause a complete denial of service without needing the Git node in the workflow at all.

The remediation is straightforward: reject dangerous property names such as __proto__, constructor, and prototype before using them as object keys, or use Object.create(null) for the customSchemas object to eliminate prototype inheritance entirely. Notably, n8n's codebase already contains a deepMerge utility with prototype pollution guards, but the GSuiteAdmin node was not using it. The report was submitted to n8n's security team on 2025-02-26, and the advisory and CVE were published on 2025-03-25. Only one feed is carrying this story, so corroboration is limited.