VulnSocial
← Back to blog

CVE-2025-68613 – Critical Remote Code Execution in n8n Automation Platform

Key takeaways

  • Critical Remote Code Execution (CVSS 9.9/8.8) in n8n expression evaluation.
  • Authenticated attackers can execute arbitrary code with the n8n process privileges.
  • CISA KEV confirms active exploitation.
  • Immediate patch to 1.120.4, 1.121.1, or 1.122.0; otherwise restrict workflow editing to trusted users.
  • Monitor for exploit attempts via logs and the VulnSocial CVE page.

CVE-2025-68613 is a Critical Remote Code Execution flaw in n8n that allows authenticated attackers to run arbitrary commands on the host. The vulnerability has seen active exploitation and is listed in the CISA KEV catalog.

Overview

CVE-2025-68613 was disclosed on 2025‑12‑19 and affects the popular open‑source workflow automation platform n8n. The flaw resides in the workflow expression evaluation engine, which under certain conditions runs user‑supplied JavaScript in an execution context that is not sufficiently sandboxed. An attacker who can create or edit a workflow (authenticated but with low privileges) can inject malicious expressions that execute arbitrary commands on the host running n8n.

CISA KEV added the vulnerability to its Known Exploited Vulnerabilities catalog on 2026‑03‑11, labeling it as active exploitation. Threat intelligence shows a sharp rise in exploit chatter and public PoC releases between 2026‑03‑01 and 2026‑03‑12, with dozens of daily mentions and multiple exploit‑tool reports.

Technical Details

The vulnerable component is the workflow expression evaluation system. Expressions are evaluated using eval‑like semantics without a robust isolation layer. This enables Improper Control of Dynamically‑Managed Code Resources (CWE‑913). An attacker can craft a payload such as:

{{ require('child_process').execSync('id') }}

When the malicious expression is saved in a workflow, n8n executes the execSync call in the context of the n8n process, which typically runs with the privileges of the service account. This exploit grants the attacker full system control.

The CVSS vector strings are:

  • NIST: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (CVSS 8.8 (High))
  • GitHub: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (CVSS 9.9 (Critical))

The “S:C” flag in the GitHub vector indicates a scope change, reflecting that the compromised process can affect the entire host.

Severity & Impact

MetricScore
CVSS (NIST)8.8 (High)
CVSS (GitHub)9.9 (Critical)
CWECWE‑913

Impact – Successful exploitation grants the attacker full control of the n8n process, allowing:

  • Access to sensitive data stored in workflows or environment variables.
  • Modification or deletion of existing workflows.
  • Execution of arbitrary system commands, potentially leading to lateral movement.

Affected Products

All n8n installations running versions starting with 0.211.0 up to (but not including) 1.120.4, 1.121.1, and 1.122.0 are vulnerable. The platform runs on node.js, so the issue propagates to any deployment model (Docker, Kubernetes, bare‑metal, or cloud‑hosted).

For a complete list of affected versions, see the VulnSocial CVE page.

What to Do Now

  • Patch immediately to one of the fixed releases: 1.120.4, 1.121.1, or 1.122.0. Example upgrade command:
npm install [email protected]   # npm install
# or for Docker
docker pull n8n/n8n:1.122.0
  • If a direct upgrade is not possible, restrict workflow creation and editing to a small set of trusted accounts (e.g., admin‑only).
  • Deploy n8n in a hardened container or VM with:
    • Non‑root user execution.
    • Limited filesystem access (read‑only for code directories).
    • Network egress filtering to prevent outbound command‑and‑control traffic.
  • Enable audit logging for workflow changes and monitor for suspicious expression patterns (e.g., require(, execSync, process.).
  • Track live threat activity on the VulnSocial CVE page.

Remediation & Mitigation

  1. Patch: Upgrade to the latest stable release (≥ 1.122.0). Verify the version with n8n --version.
  2. Permission hardening: Limit the workflow:edit and workflow:create permissions to administrators only.
  3. Runtime isolation: Run n8n under a dedicated, low‑privilege user account; apply container security profiles (e.g., seccomp, AppArmor).
  4. Network segmentation: Place the n8n service behind a firewall and restrict outbound connections to only required endpoints.
  5. Monitoring: Set up alerts for:
    • New workflow saves containing the string {{ followed by require( or execSync.
    • Unexpected process creation events on the host.
    • Increased outbound traffic from the n8n container.

Bottom Line

CVE-2025-68613 is a Critical Remote Code Execution flaw in n8n that is actively exploited. The fastest path to safety is an immediate patch to a fixed version, coupled with strict workflow permission controls and runtime hardening.

References

#CVE #Critical #RCE #CISAKEV #n8n #CVE202568613