PT-2025-52530 · N8N · N8N

Fatihhcelik · CVE-2025-68613 · Published 2025-12-19 · Updated 2026-07-28

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions n8n versions 0.211.0 through 1.120.3 n8n versions 1.121.0 through 1.121.0 n8n versions 1.122.0 (affected versions not specified)

Description A critical Remote Code Execution (RCE) issue exists in the workflow expression evaluation system. Authenticated users can provide expressions during workflow configuration that are evaluated in an execution context insufficiently isolated from the underlying runtime. This allows an attacker to execute arbitrary code with the privileges of the n8n process, potentially leading to full instance compromise, unauthorized sensitive data access, and system-level operations. Approximately 24,700 unpatched instances are publicly accessible worldwide, primarily in North America and Europe. The Zerobot botnet has been observed exploiting this flaw to hijack automated workflows for malicious command execution.

Recommendations Upgrade to versions 1.120.4, 1.121.1, or 1.122.0. Limit workflow creation and editing permissions to fully trusted users only. Deploy n8n in a hardened environment with restricted operating system privileges and network access.

Exploit

Fix

LPE

RCE

Weakness Enumeration

CWE-913

Related Identifiers

BDU:2025-16183

CVE-2025-68613

GHSA-V98V-FF95-F3CP

Affected Products

N8N

References · 294

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68613.json · Exploit
• 🔥 https://github.com/rxerium/CVE-2025-68613 · Exploit
• 🔥 https://github.com/TheStingR/CVE-2025-68613-POC · Exploit
• 🔥 https://akamai.com/blog/security-research/2026/feb/zerobot-malware-targets-n8n-automation-platform · Exploit
• https://github.com/n8n-io/n8n/commit/39a2d1d60edde89674ca96dcbb3eb076ffff6316 · Patch
• https://github.com/n8n-io/n8n/commit/08f332015153decdda3c37ad4fcb9f7ba13a7c79 · Patch
• https://github.com/n8n-io/n8n/commit/1c933358acef527ff61466e53268b41a04be1000 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-68613 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2025-68613 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v98v-ff95-f3cp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-68613 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-16183 · Security Note
• https://github.com/n8n-io/n8n · Note
• https://github.com/n8n-io/n8n/security/advisories/GHSA-v98v-ff95-f3cp · Security Note, Vendor Advisory
• https://reddit.com/r/CVEWatch/comments/1rhuktk/top_10_trending_cves_01032026 · Reddit Post