CVE-2025-68613— n8n Vulnerable to Remote Code Execution via Expression Injection
Quick assessment
Affected
n8n-io n8n
Exploitation
Confirmed exploitation in the wild; remediate immediately
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
n8n是n8n开源的一个可扩展的工作流自动化工具。 n8n 0.211.0版本至1.120.4版本、1.121.1版本和1.122.0版本之前版本存在安全漏洞，该漏洞源于工作流表达式评估系统隔离不足，可能导致远程代码执行。
Public Exploits 2
Metasploit · 1
n8n_workflow_expression_rce.rb [exploit]
Nuclei · 1
CVE-2025-68613.yaml [template]
In-the-Wild Activity Observed
cisa_kev · confirmed
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-68613
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
n8n Vulnerable to Remote Code Execution via Expression Injection
Source: CVE Program / CVE List V5
Vulnerability Description
n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4, 1.121.1, and 1.122.0 contain a critical Remote Code Execution (RCE) vulnerability in their workflow expression evaluation system. Under certain conditions, expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime. An authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations. This issue has been fixed in versions 1.120.4, 1.121.1, and 1.122.0. Users are strongly advised to upgrade to a patched version, which introduces additional safeguards to restrict expression evaluation. If upgrading is not immediately possible, administrators should consider the following temporary mitigations: Limit workflow creation and editing permissions to fully trusted users only; and/or deploy n8n in a hardened environment with restricted operating system privileges and network access to reduce the impact of potential exploitation. These workarounds do not fully eliminate the risk and should only be used as short-term measures.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
动态管理代码资源的控制不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
n8n 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
n8n是n8n开源的一个可扩展的工作流自动化工具。 n8n 0.211.0版本至1.120.4版本、1.121.1版本和1.122.0版本之前版本存在安全漏洞，该漏洞源于工作流表达式评估系统隔离不足，可能导致远程代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
II. Public POCs for CVE-2025-68613
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | Detection for CVE-2025-68613 | https://github.com/rxerium/CVE-2025-68613 | POC Details |
| 2 | CVE-2025-68613 | https://github.com/Ashwesker/Blackash-CVE-2025-68613 | POC Details |
| 3 | Public PoC + Scanner and research for CVE-2025-68613: Critical RCE in n8n Workflow Automation via Expression Injection (CVSS 10.0). Includes detection tools, full exploit, and remediation guidance. | https://github.com/TheStingR/CVE-2025-68613-POC | POC Details |
| 4 | CVE-2025-68613: n8n RCE vulnerability exploit and documentation | https://github.com/wioui/n8n-CVE-2025-68613-exploit | POC Details |
| 5 | 通过GitHub Copilot 辅助分析CVE-2025-68613漏洞 | https://github.com/intbjw/CVE-2025-68613-poc-via-copilot | POC Details |
| 6 | None | https://github.com/ali-py3/Exploit-CVE-2025-68613 | POC Details |
| 7 | This repository contains a laboratory-grade analysis and a **safe Proof-of-Concept** for the vulnerability **CVE-2025-68613**, affecting the workflow automation platform **n8n**. | https://github.com/nehkark/CVE-2025-68613 | POC Details |
| 8 | My poc to exploit this vuln :D | https://github.com/GnuTLam/POC-CVE-2025-68613 | POC Details |
| 9 | n8n < 1.120.4, 1.121.1, 1.122.0 contains a remote code execution caused by insufficient isolation in workflow expression evaluation, letting authenticated attackers execute arbitrary code with n8n process privileges. Exploit requires authentication. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-68613.yaml | POC Details |
| 10 | 基于Pocsuite3 框架编写的漏洞验证与利用脚本，用于检测 n8n工作流自动化工具中的认证后远程代码执行漏洞（RCE） | https://github.com/secjoker/CVE-2025-68613 | POC Details |
| 11 | Analysis of CVE-2025-68613 | https://github.com/r4j3sh-com/CVE-2025-68613-n8n-lab | POC Details |
| 12 | None | https://github.com/intelligent-ears/CVE-2025-68613 | POC Details |
| 13 | GUI Shodan-powered scanner to identify n8n instances exposed to CVE-2025-68613 (version range 0.211.0–1.122.0) | https://github.com/manyaigdtuw/CVE-2025-68613_Scanner | POC Details |
| 14 | Remote Code Execution via n8n Workflows (Based on CVE-2025-68613) | https://github.com/AbdulRKB/n8n-RCE | POC Details |
| 15 | Python Exploit for CVE-2025-68613. | https://github.com/JohannesLks/CVE-2025-68613-Python-Exploit | POC Details |
| 16 | n8n God Mode Ultimate - CVE-2025-68613 Scanner v1.0.0 ║ ║ Workflow Automation Remote Code Execution | https://github.com/hackersatyamrastogi/n8n-exploit-CVE-2025-68613-n8n-God-Mode-Ultimate | POC Details |
| 17 | Proof-of-Concept exploit for CVE-2025-68613: Authenticated Remote Code Execution in n8n via Expression Injection | https://github.com/mbanyamer/n8n-Authenticated-Expression-Injection-RCE-CVE-2025-68613 | POC Details |
| 18 | Technical study of the CVE-2025-68613 vulnerability in n8n, covering affected versions, laboratory exploration scenario, offensive and defensive analysis, and mitigation strategies. | https://github.com/releaseown/Analysis-n8n-CVE-2025-68613 | POC Details |
| 19 | None | https://github.com/Dlanang/homelab-CVE-2025-68613 | POC Details |
| 20 | None | https://github.com/Khin-96/n8n-cve-2025-68613-thm | POC Details |
| 21 | The minor methodology for room: https://tryhackme.com/room/n8ncve202568613 | https://github.com/J4ck3LSyN-Gen2/n8n-CVE-2025-68613-TryHackMe | POC Details |
| 22 | CVE-2025-68613 (n8n) Critical RCE analysis + defensive recommendations (patch validation, detection ideas, and hardening tips) | https://github.com/Ak-cybe/CVE-2025-68613-n8n-rce-analysis | POC Details |
| 23 | This laboratory provides a controlled environment to analyze and reproduce CVE-2025-68613 in a vulnerable n8n instance. | https://github.com/LingerANR/n8n-CVE-2025-68613 | POC Details |
| 24 | POC for CVE-2025-68613 | https://github.com/reem-012/poc_CVE-2025-68613 | POC Details |
| 25 | Technical study of the CVE-2025-68613 vulnerability in n8n, covering affected versions, laboratory exploration scenario, offensive and defensive analysis, and mitigation strategies. | https://github.com/releaseown/analysis-and-poc-n8n-CVE-2025-68613 | POC Details |
| 26 | n8n CVE-2025-68613 | https://github.com/gagaltotal/n8n-cve-2025-68613 | POC Details |
| 27 | CVE-2025-68613 | https://github.com/Ashwesker/Ashwesker-CVE-2025-68613 | POC Details |
| 28 | None | https://github.com/cv-sai-kamesh/n8n-CVE-2025-68613 | POC Details |
| 29 | n8n RCE (CVE-2025-68613) - Proof of Concept | https://github.com/ahmedshamsddin/n8n-RCE-CVE-2025-68613 | POC Details |
| 30 | Expression injection payloads for n8n CVE-2025-68613 RCE | https://github.com/TheInterception/n8n_CVE-2025-68613_exploit_payloads | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-68613
请登录查看更多情报信息。
Patches & Fixes for CVE-2025-68613 (3)
IV. Related Vulnerabilities
Same product: n8n
-
CVE-2026-103260
n8n before 2.39.6 and 2.40.x before 2.40.1 Approval Bypass v -
CVE-2026-103259
n8n before 2.39.6 and 2.40.x before 2.40.1 Session Token Lea -
CVE-2026-103258
n8n before 2.39.6 and 2.40.x before 2.40.1 Filter Bypass via -
CVE-2026-103257
n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via n -
CVE-2026-103256
n8n before 2.39.6 and 2.40.x before 2.40.1 Credentials Leak
Same vendor: n8n-io
-
CVE-2026-103260
n8n before 2.39.6 and 2.40.x before 2.40.1 Approval Bypass v -
CVE-2026-103259
n8n before 2.39.6 and 2.40.x before 2.40.1 Session Token Lea -
CVE-2026-103258
n8n before 2.39.6 and 2.40.x before 2.40.1 Filter Bypass via -
CVE-2026-103257
n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via n -
CVE-2026-103256
n8n before 2.39.6 and 2.40.x before 2.40.1 Credentials Leak
Same weakness: CWE-913
-
CVE-2026-92955
vm2 before 3.11.8 Sandbox Escape via NodeVM -
CVE-2026-92953
vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray -
CVE-2026-92946
vm2 before 3.11.7 Remote Code Execution via require.external -
CVE-2026-92935
vm2 NodeVM Remote Code Execution via Array-Shaped Require -
CVE-2026-12354
IBM MQ Resource Adapter IVT message-driven bean is vulnerabl
V. Comments for CVE-2025-68613
No comments yet