PT-2025-52530 · N8N · N8N

Fatihhcelik · Published 2025-12-19 · Updated 2026-03-16 · CVE-2025-68613

Positive Technologies · (AI Summary)

CVSS v3.1

9.9

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions n8n versions 0.211.0 through 1.120.3

Description n8n, an open-source workflow automation platform, is affected by a critical Remote Code Execution (RCE) vulnerability (CVE-2025-68613) with a CVSS score of 9.9. This flaw stems from insufficient isolation in the expression evaluation engine, allowing authenticated users to inject malicious code and execute arbitrary commands with the privileges of the n8n process. Successful exploitation could lead to full system compromise, including unauthorized data access, workflow manipulation, and system-level operations. Over 100,000 instances are estimated to be exposed. The vulnerability allows authenticated users to bypass the sandbox and execute code. Public Proof-of-Concept (PoC) exploits are available.

Recommendations Upgrade to version 1.120.4, 1.121.1, or 1.122.0 to address this vulnerability. If upgrading is not immediately possible, restrict workflow creation and editing permissions to fully trusted users only and deploy n8n in a hardened environment with restricted operating system privileges and network access.

Exploit

Fix

RCE

LPE

Weakness Enumeration

CWE-913

Related Identifiers

BDU:2025-16183

CVE-2025-68613

GHSA-V98V-FF95-F3CP

Affected Products

N8N

References · 268

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68613.json · Exploit
• 🔥 https://github.com/rxerium/CVE-2025-68613 · Exploit
• 🔥 https://github.com/TheStingR/CVE-2025-68613-POC · Exploit
• 🔥 https://akamai.com/blog/security-research/2026/feb/zerobot-malware-targets-n8n-automation-platform · Exploit
• https://github.com/n8n-io/n8n/commit/1c933358acef527ff61466e53268b41a04be1000 · Patch
• https://github.com/n8n-io/n8n/commit/39a2d1d60edde89674ca96dcbb3eb076ffff6316 · Patch
• https://github.com/n8n-io/n8n/commit/08f332015153decdda3c37ad4fcb9f7ba13a7c79 · Patch
• https://osv.dev/vulnerability/GHSA-v98v-ff95-f3cp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68613 · Security Note
• https://bdu.fstec.ru/vul/2025-16183 · Security Note
• https://osv.dev/vulnerability/CVE-2025-68613 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2025-68613 · Vendor Advisory
• https://github.com/n8n-io/n8n · Note
• https://github.com/n8n-io/n8n/security/advisories/GHSA-v98v-ff95-f3cp · Security Note, Vendor Advisory
• https://twitter.com/Anavem_/status/2008204781412667820 · Twitter Post