PT-2025-52530 · N8N · N8N

Fatihhcelik · Published 2025-12-19 · Updated 2026-04-06 · CVE-2025-68613

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions n8n versions 0.211.0 through 1.120.3

Description n8n, an open-source workflow automation platform, is affected by a critical Remote Code Execution (RCE) vulnerability (CVE-2025-68613) with a CVSS score of 9.9. This flaw stems from an expression injection vulnerability within the platform’s workflow evaluation system. Authenticated users can exploit this to execute arbitrary code on the underlying server, potentially gaining full system compromise, accessing sensitive data, and manipulating workflows. Over 100,000 instances are reported to be exposed. The vulnerability allows attackers to bypass sandbox isolation and execute code with the privileges of the n8n process. Active exploitation of this vulnerability has been confirmed, and CISA has added it to its Known Exploited Vulnerabilities (KEV) catalog.

Recommendations Upgrade n8n to version 1.120.4 or later (including 1.121.1 and 1.122.0) immediately. If upgrading is not immediately possible, restrict access to workflow creation and editing to fully trusted users only.

Exploit

Fix

LPE

RCE

Weakness Enumeration

CWE-913

Related Identifiers

BDU:2025-16183

CVE-2025-68613

GHSA-V98V-FF95-F3CP

Affected Products

N8N

References · 288

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68613.json · Exploit
• 🔥 https://github.com/rxerium/CVE-2025-68613 · Exploit
• 🔥 https://github.com/TheStingR/CVE-2025-68613-POC · Exploit
• 🔥 https://akamai.com/blog/security-research/2026/feb/zerobot-malware-targets-n8n-automation-platform · Exploit
• https://github.com/n8n-io/n8n/commit/39a2d1d60edde89674ca96dcbb3eb076ffff6316 · Patch
• https://github.com/n8n-io/n8n/commit/08f332015153decdda3c37ad4fcb9f7ba13a7c79 · Patch
• https://github.com/n8n-io/n8n/commit/1c933358acef527ff61466e53268b41a04be1000 · Patch
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2025-68613 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68613 · Security Note
• https://bdu.fstec.ru/vul/2025-16183 · Security Note
• https://osv.dev/vulnerability/CVE-2025-68613 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v98v-ff95-f3cp · Vendor Advisory
• https://github.com/n8n-io/n8n · Note
• https://github.com/n8n-io/n8n/security/advisories/GHSA-v98v-ff95-f3cp · Vendor Advisory, Security Note
• https://twitter.com/wazuh/status/2005964678917230888 · Twitter Post