/Vulnerability Library

n8n - Remote Code Execution via Expression Injection

CVE-2025-68613
Verified

Description

n8n < 1.120.4, 1.121.1, 1.122.0 contains a remote code execution caused by insufficient isolation in workflow expression evaluation, letting authenticated attackers execute arbitrary code with n8n process privileges. Exploit requires authentication.

Severity

Critical

CVSS Score

9.9

Exploit Probability

99%

Affected Product

n8n

Published Date

December 24, 2025

Template Author

rxerium, pentesterflow, muhamadjuwandi

CVE-2025-68613.yaml
9.9Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVE ID:
cve-2025-68613
CWE ID:
cwe-94

References

https://github.com/n8n-io/n8n/security/advisories/GHSA-v98v-ff95-f3cphttps://nvd.nist.gov/vuln/detail/CVE-2025-68613

Remediation Steps

Upgrade to versions 1.120.4, 1.121.1, or 1.122.0 or later.