Overview (n8n and CVE-2025-68613)

n8n is a workflow automation platform used to integrate systems and services through visual flows and JavaScript expressions.

CVE-2025-68613 is a critical Remote Code Execution (RCE) vulnerability, with CVSS 9.9, affecting multiple versions of n8n. The flaw occurs in the processing of JavaScript expressions in workflows in vulnerable versions that are not properly isolated. This allows authenticated users with edit permissions to execute code outside the application's expected behavior.

In practice, this flaw can be exploited to run commands on the server where n8n is running, using the application's own privileges. Affected versions range from 0.211.0 up to versions prior to the fixes applied in 1.120.4, 1.121.1 and 1.122.0.

Potential Impact

Full compromise of the n8n instance.
Access to data processed by workflows.
Exposure of credentials, SSH keys, environment variables and integration tokens.
Indirect access to connected systems.

This repository documents CVE-2025-68613 technically, covering the context of the flaw, affected versions, exploitation and recommended mitigation measures.

n8n search in hunter

Affected and Fixed Versions

It is recommended to update immediately to version 1.122.0 or higher.

Proof of Concept (PoC)

Scenario Preconditions

To demonstrate the vulnerability, the following conditions are required:

n8n instance running a vulnerable version
Authenticated user
Write permissions (creation or editing of workflows)

The flaw occurs during creation and execution of workflows, not before authentication.

Exploitation Steps

Step 1 — Authentication on the Platform

The first step is to log in to the n8n web interface with a valid user.

n8n login screen

This step confirms the attack is not anonymous. The vulnerability requires an authenticated user.

Step 2 — Permission Confirmation

After logging in, verify that the user has permissions to create and edit workflows.

User management screen

This is relevant because only users with this access level can insert dynamic expressions into workflows.

Step 3 — Creating a New Workflow

With the authenticated user, create a new workflow from scratch.

Initial screen for creating a workflow

Here begins the legitimate use of n8n functionality that, in vulnerable versions, can be exploited.

Step 4 — Adding the Manual Trigger

The first node added to the workflow is the Manual Trigger.

Adding the Manual Trigger

What this node does: Allows manual execution of the workflow, used as the starting point of the flow.

In this scenario, it only serves as an entry point for workflow execution.

Step 5 — Adding the Edit Fields (Set) Node

The second node added is the Edit Fields (Set).

Adding the Edit Fields (Set) node

What this node does: This node allows creating, modifying or overwriting data fields within the workflow. It accepts static values or JavaScript expressions evaluated at execution time.

It is precisely at this point that the vulnerability manifests.

Step 6 — Inserting the Vulnerable Expression

Inside the value field of the Edit Fields (Set) node, insert a JavaScript expression wrapped by {{ }}, which is the format used by n8n to evaluate dynamic expressions.

Expression field with payload

Example payload:

{{ (function(){ 
  return this.process.mainModule
    .require('child_process')
    .execSync('id')
    .toString() 
})() }}

(function(){ ... })(): Defines a self-invoking function, allowing encapsulation of all logic and returning a value directly to the workflow expression.
this.process: Accesses the internal Node.js process object, which exposes runtime information and resources.
process.mainModule: Allows access to the application's main module, enabling loading of other internal Node.js modules.
require('child_process'): Native Node.js module that allows creating new processes on the operating system and executing external commands.
execSync('id'): Executes a command directly on the operating system where n8n is running, using the application's process privileges.
.toString(): Converts the executed command's output to text, allowing the result to be displayed in the n8n interface.

Final Result

The displayed result confirms that the command was executed on the operating system using the n8n process privileges, characterizing a Remote Code Execution (RCE).

❌ Affected	>= 0.211.0	Introduction of the vulnerable mechanism
❌ Affected	< 1.120.4	Vulnerable until the patch in branch 1.120
❌ Affected	< 1.121.1	Vulnerable until the patch in branch 1.121
❌ Affected	< 1.122.0	Vulnerable until the patch in branch 1.122
✅ Fixed	1.120.4	Official fix applied
✅ Fixed	1.121.1	Official fix applied
✅ Fixed	>= 1.122.0	Fix incorporated by default

Most Popular

analysis-and-poc-n8n-CVE-2025-68613