nehkark/cve-2025-68613This repository contains a laboratory-grade analysis and a **safe Proof-of-Concept** for the vulnerability **CVE-2025-68613**, affecting the workflow automation platform **n8n**.
The author assumes no liability for misuse or damage caused by this research
Provided strictly for educational and defensive purposes
This repository contains a laboratory-grade analysis and a safe Proof-of-Concept for the vulnerability CVE-2025-68613, affecting the workflow automation platform n8n.
Versions starting with 0.211.0 and prior to 1.120.4, as well as 1.121.0–1.121.1, contain a critical flaw in the expression evaluation system.
Under specific conditions, expressions supplied by authenticated users may be evaluated in a runtime context that lacks proper isolation, theoretically enabling remote code execution (RCE).
This repository does not provide exploitation
It provides:
CVE-2025-68613 originates from inadequate sandboxing inside the expression engine used during workflow execution.
A malicious authenticated user may bypass expression isolation and reach underlying runtime objects, potentially enabling system-level actions.
Impact includes:
Misconfigured or publicly exposed n8n instances increase the risk dramatically.
This PoC is safe and non-destructive. It validates:
From GET /signin, using Base64-encoded metadata.
Matches version against known vulnerable ranges.
Calls /rest/settings, which in vulnerable deployments returns:
Exposing such internal values indicates weakened isolation, a key requirement for the vulnerability.
This PoC does not perform RCE.
CVE-2025-68613/
│
├── cve-2025-68613.py
└── README.md
python3 cve-2025-68613.py -u https://127.0.0.1 -p 443 --insecure
Example:
n8n CVE-2025-68613 Vulnerability Scanner
----------------------------------------
[•] Target: https://127.0.0.1:443
[•] Performing version fingerprinting...
[✓] Detected n8n version: 1.120.0
[!] Vulnerable to CVE-2025-68613
If the instance is safe:
[✓] Target is NOT vulnerable. No further action required.
If the scanner detects a vulnerable version, the PoC automatically proceeds:
python cve-2025-68613.py -u 127.0.0.1 -p 443 --poc -v -k
Example:
python cve-2025-68613.py -u 127.0.0.1 -p 443 --poc -v -k
n8n CVE-2025-68613 Vulnerability Scanner
------------------------------------------
[•] Target: https://127.0.0.1:443
[•] Performing version fingerprinting...
[DEBUG] Fetching: https://127.0.0.1:443/signin
[✓] Detected n8n version: 1.120.0
[!] Vulnerable to CVE-2025-68613
[•] Running SAFE PoC to validate exposure...
[DEBUG] Querying settings: https://127.0.0.1:443/rest/settings
[✓] SAFE POC CONFIRMED
The instance exposes internal configuration without authentication.
This correlates with weakened backend isolation seen in vulnerable builds.
--- Metadata Fragment (Pretty Printed) ---
{
"data": {
"authCookie": {
"secure": true
},
"banners": {
"dismissed": [
"V1"
]
},
"defaultLocale": "en",
"enterprise": {
"ldap": false,
"oidc": false,
"saml": false,
"showNonProdBanner": false
},
"instanceId": "ab12eeb1234d5a12ee12c123caa86aca12345fc1234567fbc3e29b6e12f123cd",
"mfa": {
"enabled": true,
"enforced": false
},
"oauthCallbackUrls": {
"oauth1": "http://0.0.0.0:5678/rest/oauth1-credential/callback",
"oauth2": "http://0.0.0.0:5678/rest/oauth2-credential/callback"
},
"previewMode": false,
"releaseChannel": "dev",
"settingsMode": "public",
"sso": {
"ldap": {
"loginEnabled": false,
"loginLabel": ""
},
"oidc": {
"callbackUrl": "http://0.0.0.0:5678/rest/sso/oidc/callback",
"loginEnabled": false,
"loginUrl": "http://0.0.0.0:5678/rest/sso/oidc/login"
},
"saml": {
"loginEnabled": false,
"loginLabel": ""
}
},
"telemetry": {
"config": {
"key": "1zAn2bcDEz3Fc4p5Gh6uiJ7KLMn",
"proxy": "http://0.0.0.0:5678/rest/telemetry/proxy",
"sourceConfig": "http://0.0.0.0:5678/rest/telemetry/rudderstack",
"url": "https://telemetry.n8n.io"
},
"enabled": true
},
"userManagement": {
"authenticationMethod": "email",
"quota": -1,
"showSetupOnFirstLoad": false,
"smtpSetup": false
},
"versionCli": "1.120.0",
"versionNotifications": {
"enabled": true,
"endpoint": "https://api.n8n.io/api/versions/",
"infoUrl": "https://docs.n8n.io/hosting/installation/updating/",
"whatsNewEnabled": true,
"whatsNewEndpoint": "https://api.n8n.io/api/whats-new"
}
}
}
| Affected Range | Patched Versions |
|---|---|
| 0.211.0 → < 1.120.4 | 1.120.4+ |
| 1.121.0 → < 1.121.1 | 1.121.1+ |
| 1.122.x | 1.122.0+ |
Mitigations:
cve-2025-68613.py provides:
--insecure)Example:
python3 cve-2025-68613.py -u https://n8n.lab -p 5678 --poc --insecure