CVE-2025-68613
n8n Improper Control of Dynamically-Managed Code Resources Vulnerability
Description
CVE-2025-68613 is a CRITICAL remote code execution vulnerability in n8n, the popular workflow automation platform, carrying a CVSS 3.1 score of 9.9. The flaw exists in the workflow expression evaluation system, where expressions during workflow configuration are evaluated in an insufficiently isolated context, allowing an authenticated user with low privileges to achieve arbitrary code execution on the server. Affected versions range from 0.211.0 to before 1.120.4, 1.121.1, and 1.122.0. This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2026-03-11 with a remediation deadline of 2026-03-25. With an EPSS score of 0.769 (76.9%), this vulnerability has an extremely high probability of exploitation and demands immediate action.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| n8n | n8n | >= 0.211.0, < 1.120.4; 1.121.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/n8n-io/n8n/commit/08f332015153decdda3c37ad4fcb9f7ba13a7c79(Patch)
- https://github.com/n8n-io/n8n/commit/1c933358acef527ff61466e53268b41a04be1000(Patch)
- https://github.com/n8n-io/n8n/commit/39a2d1d60edde89674ca96dcbb3eb076ffff6316(Patch)
- https://github.com/n8n-io/n8n/security/advisories/GHSA-v98v-ff95-f3cp(Patch, Vendor Advisory)
- https://www.akamai.com/blog/security-research/2026/feb/zerobot-malware-targets-n8n-automation-platform(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-68613(US Government Resource)
Weakness Type
CWE-913: Improper Control of Dynamically-Managed Code Resources
CVE-2025-68613 is classified under CWE-913 — Improper Control of Dynamically-Managed Code Resources. This weakness occurs when software does not adequately restrict the creation, modification, or execution of dynamically managed code resources such as scripts, expressions, or templates. When user-controlled input can influence code that is subsequently evaluated or executed, attackers can inject malicious logic that runs with the privileges of the application.
In the context of n8n, this weakness is exceptionally dangerous. Workflow automation platforms inherently rely on expression evaluation to enable dynamic data processing across workflow nodes. When the expression evaluation sandbox is insufficiently isolated, a low-privileged user who can configure workflows can break out of the intended evaluation context and execute arbitrary system commands on the underlying server. Given that n8n instances often have access to sensitive integrations, API keys, databases, and internal network resources, a sandbox escape in the expression evaluator effectively grants an attacker access to the entire server and connected infrastructure.
Impact Analysis
CVE-2025-68613 carries a CVSS 3.1 score of 9.9 (CRITICAL) with the vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
Confidentiality (HIGH): An attacker can read arbitrary files on the n8n server, access environment variables containing API keys and secrets, extract database credentials, and access any data reachable from the server's network position. The Changed scope means the attacker can also impact resources beyond the n8n application itself.
Integrity (HIGH): Full code execution on the server allows modification of workflows, injection of backdoors, alteration of data processed by workflows, and deployment of persistent access mechanisms. Connected integrations and downstream systems are also at risk.
Availability (HIGH): The attacker can terminate the n8n service, corrupt workflow data, consume server resources, or render the entire automation infrastructure inoperable.
Scope Changed (S:C): This is particularly significant — exploitation of n8n can impact other components and systems beyond n8n itself. The server hosting n8n, connected databases, integrated third-party services, and internal network resources are all within reach, amplifying the blast radius far beyond the vulnerable application.
Exploit Maturity
CVE-2025-68613 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog as of 2026-03-11.
Exploit status: The vulnerability is actively exploited, with the exceptionally high EPSS score of 76.9% confirming widespread exploitation activity. Expression evaluation sandbox escapes in workflow automation tools are highly attractive to attackers because they provide immediate code execution on servers that typically have broad network access and contain valuable credentials.
Ransomware association: Given the remote code execution capability and the typical deployment profile of n8n instances (servers with access to multiple integrations and internal systems), this vulnerability class is highly attractive for ransomware operators seeking initial access or lateral movement.
Attack surface: Any n8n instance running versions 0.211.0 through 1.120.3, 1.121.0, or earlier than 1.122.0 is vulnerable. The attack requires only low-level authentication (a standard user account), and many n8n deployments are internet-facing. No user interaction is required beyond initial authentication.
KEV deadline: CISA has set a remediation deadline of 2026-03-25. The critical severity, changed scope, and extremely high EPSS score make this one of the most urgent vulnerabilities to address.
Remediation
- Update n8n immediately. Upgrade to n8n version 1.120.4, 1.121.1, or 1.122.0 (or later) depending on your release track. This is the most critical action to take.
- Restrict network access to n8n instances. If not already implemented, ensure n8n instances are not directly exposed to the internet. Place them behind a VPN or reverse proxy with strong authentication. Limit access to only authorized users who require workflow management capabilities.
- Audit user accounts and permissions. Review all user accounts on affected n8n instances. Remove unnecessary accounts and enforce the principle of least privilege. Since the vulnerability requires only low-level authentication, any compromised or shared account could be used for exploitation.
- Rotate all credentials accessible from the n8n server. Assume that API keys, database credentials, integration tokens, and other secrets stored in n8n workflows or environment variables may have been compromised. Rotate all credentials as a precautionary measure.
- Investigate for signs of compromise. Review n8n execution logs for suspicious workflow expressions, unexpected workflow modifications, or unusual execution patterns. Check server logs for anomalous process execution, outbound network connections, or file system modifications. Examine connected systems for unauthorized access.
- Implement monitoring and alerting. Deploy enhanced logging on n8n instances and the underlying servers. Monitor for suspicious expression patterns in workflow configurations and unexpected child process creation from the n8n process.
Technical Details
CVE-2025-68613 is a CRITICAL remote code execution vulnerability in n8n's workflow expression evaluation system. The vulnerability is exploitable over the network with low attack complexity. Only low-level privileges (a standard authenticated user) are required, and no user interaction is needed. The scope is Changed, meaning exploitation impacts resources beyond the n8n application boundary.
Technical mechanism: n8n uses an expression evaluation system to allow dynamic values within workflow configurations. Expressions enclosed in specific delimiters are parsed and executed to resolve variables, transform data, and implement conditional logic. The flaw lies in the insufficient isolation of the evaluation context — the sandbox mechanism intended to restrict expression capabilities can be bypassed. An attacker with workflow configuration access can craft expressions that escape the sandbox and execute arbitrary JavaScript code in the Node.js runtime context of the n8n server. This grants access to Node.js built-in modules including child_process, fs, and net, enabling system command execution, file system access, and network operations.
CVSS 3.1 vector analysis (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H): The Network attack vector reflects that n8n is typically accessed over HTTP/HTTPS. Low complexity indicates the sandbox escape is reliable and straightforward. Low privileges are required (any authenticated user). No user interaction is needed. The Changed scope (S:C) is the critical differentiator — the attacker breaks out of the n8n application boundary to impact the underlying server and connected systems. All impact metrics are HIGH.
Affected versions: n8n versions 0.211.0 through versions prior to 1.120.4, 1.121.1, and 1.122.0.
Frequently Asked Questions
What is CVE-2025-68613?
CVE-2025-68613 is a CRITICAL (CVSS 9.9) remote code execution vulnerability in n8n, a workflow automation platform. The flaw is in the expression evaluation system, which evaluates workflow expressions in an insufficiently isolated context, allowing authenticated users to execute arbitrary code on the server. It is actively exploited and listed in CISA's KEV catalog.
Which versions of n8n are affected?
n8n versions from 0.211.0 up to (but not including) 1.120.4, 1.121.1, and 1.122.0 are affected. Organizations should update to 1.120.4, 1.121.1, or 1.122.0 or later, depending on their release track.
How do I fix CVE-2025-68613?
Update n8n to version 1.120.4, 1.121.1, or 1.122.0 (or later) immediately. Additionally, restrict network access to your n8n instance, audit user accounts, rotate all credentials accessible from the n8n server, and investigate for signs of prior compromise.
How severe is CVE-2025-68613?
CVE-2025-68613 is rated CRITICAL with a CVSS score of 9.9 and an EPSS score of 76.9%. The Changed scope means exploitation impacts not just n8n but also the underlying server and all connected systems. It is actively exploited and has a CISA KEV remediation deadline of 2026-03-25. This is among the most urgent vulnerabilities to remediate.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.