PT-2025-52530 · N8N · N8N

Fatihhcelik · Published 2025-12-19 · Updated 2026-05-26 · CVE-2025-68613

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions n8n versions 0.211.0 through 1.120.3 n8n versions 1.121.0 through 1.121.0 n8n versions 1.122.0 (affected versions not specified)

Description n8n contains a Remote Code Execution (RCE) flaw in its workflow expression evaluation system. Under certain conditions, expressions provided by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime. This allows an authenticated attacker to execute arbitrary code with the privileges of the n8n process, potentially leading to full instance compromise, unauthorized access to sensitive data, modification of workflows, and execution of system-level operations. There are over 24,700 publicly accessible unpatched instances worldwide, primarily in North America and Europe. Real-world exploitation has been observed involving the Zerobot botnet hijacking automated workflows for malicious command execution.

Recommendations Update to versions 1.120.4, 1.121.1, or 1.122.0. Limit workflow creation and editing permissions to fully trusted users only. Deploy n8n in a hardened environment with restricted operating system privileges and network access to reduce the impact of potential exploitation.

Exploit

Fix

LPE

RCE

Weakness Enumeration

CWE-913

Related Identifiers

BDU:2025-16183

CVE-2025-68613

GHSA-V98V-FF95-F3CP

Affected Products

N8N

References · 290

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68613.json · Exploit
• 🔥 https://github.com/rxerium/CVE-2025-68613 · Exploit
• 🔥 https://github.com/TheStingR/CVE-2025-68613-POC · Exploit
• 🔥 https://akamai.com/blog/security-research/2026/feb/zerobot-malware-targets-n8n-automation-platform · Exploit
• https://github.com/n8n-io/n8n/commit/39a2d1d60edde89674ca96dcbb3eb076ffff6316 · Patch
• https://github.com/n8n-io/n8n/commit/08f332015153decdda3c37ad4fcb9f7ba13a7c79 · Patch
• https://github.com/n8n-io/n8n/commit/1c933358acef527ff61466e53268b41a04be1000 · Patch
• https://bdu.fstec.ru/vul/2025-16183 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-68613 · Security Note
• https://osv.dev/vulnerability/GHSA-v98v-ff95-f3cp · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2025-68613 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-68613 · Vendor Advisory
• https://github.com/n8n-io/n8n · Note
• https://github.com/n8n-io/n8n/security/advisories/GHSA-v98v-ff95-f3cp · Security Note, Vendor Advisory
• https://twitter.com/S2W_Official/status/2021480471704764678 · Twitter Post