CVE-2025-68613

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2025-68613 9.9

n8n · n8n · Added 2026-03-11 · Published 2025-12-19

3-Day Required PoC Available KEV Active Exploitation

Details

Vulnerabilityn8n Improper Control of Dynamically-Managed Code Resources Vulnerability

Vendorn8n

Productn8n

Date added2026-03-11

Due date2026-03-25

CISA catalogView on CISA KEV catalog

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWECWE-913

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Descriptions

KEV: n8n contains an improper control of dynamically managed code resources vulnerability in its workflow expression evaluation system that allows for remote code execution.

NVD: n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4, 1.121.1, and 1.122.0 contain a critical Remote Code Execution (RCE) vulnerability in their workflow expression evaluation system. Under certain conditions, expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime. An authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations. This issue has been fixed in versions 1.120.4, 1.121.1, and 1.122.0. Users are strongly advised to upgrade to a patched version, which introduces additional safeguards to restrict expression evaluation. If upgrading is not immediately possible, administrators should consider the following temporary mitigations: Limit workflow creation and editing permissions to fully trusted users only; and/or deploy n8n in a hardened environment with restricted operating system privileges and network access to reduce the impact of potential exploitation. These workarounds do not fully eliminate the risk and should only be used as short-term measures.

Compliance SSVC + BOD 26-04

Automatableno

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline14 days

Forensic (public)Required

Forensic (non-public)Not required

Research metadata

Last researched2026-08-28 11:43 UTC

Wall time0.3s

Searches5

Component defaultyes

Sources https://blog.securelayer7.net/cve-2025-68613-n8n-rce-exploitation/
https://cybernoz.com/cve-2025-68613-zerobot-botnet-exploits-critical-vulnerability-impacting-n8n-ai-orchestration-platform/
https://fatihhcelik.github.io/posts/n8n-RCEs-A-Tale-of-4-Acts/
https://github.com/TheStingR/CVE-2025-68613-POC
https://github.com/TheStingR/CVE-2025-68613-POC/blob/master/exploit_cve-2025-68613.py
https://github.com/n8n-io/n8n/security/advisories/GHSA-v98v-ff95-f3cp
https://github.com/wioui/n8n-CVE-2025-68613-exploit
https://labs.cloudsecurityalliance.org/research/csa-research-note-n8n-rce-ai-pipeline-attack-surface-2026031/
https://nvd.nist.gov/vuln/detail/CVE-2025-68613
https://orca.security/resources/blog/cve-2025-68613-n8n-rce-vulnerability/
https://raw.githubusercontent.com/rapid7/metasploit-framework/eae97b314a77efba2498543f0953b14e5cc17c1c/modules/exploits/multi/http/n8n_workflow_expression_rce.rb
https://sensibleclown.com/posts/CVE-2025-68613-n8n-expression-injection-when-your-automation-hub-becomes-a-master-key/
https://www.akamai.com/blog/security-research/2026/feb/zerobot-malware-targets-n8n-automation-platform
https://www.cyber.gc.ca/en/alerts-advisories/al26-001-vulnerabilities-affecting-n8n-cve-2026-21858-cve-2026-21877-cve-2025-68613
https://www.intel471.com/blog/cve-2025-68613-zerobot-botnet-exploits-critical-vulnerability-impacting-n8n-ai-orchestration-platform
https://www.penligent.ai/hackinglabs/cve-2025-68613-authenticated-expression-injection-rce-in-n8n-cwe-913-whats-affected-what-to-patch-and-how-to-contain-it/
https://www.resecurity.com/blog/article/cve-2025-68613-remote-code-execution-via-expression-injection-in-n8n-2
https://www.scworld.com/news/cisa-adds-n8n-rce-flaw-to-list-of-known-exploited-vulnerabilities
https://www.sentinelone.com/vulnerability-database/cve-2025-68613/

Hunting hypothesis agent

Hunt n8n access logs for POST /rest/workflows with Set node expressions containing 'this.constructor.constructor' or 'process.mainModule.require' then POST /rest/workflows/{id}/run — signals sandbox escape to child_process RCE.

Research details

Componentworkflow expression evaluator — the {{ }} expression sandbox

PreconditionsExploitation of CVE-2025-68613 requires network access to an n8n instance running a vulnerable version (0.211.0 through 1.120.3, 1.121.0, or 1.121.1-1.121.x) and valid authentication credentials with permissions to create or modify workflows. The attacker does not need administrative privileges — any authenticated user with standard workflow editor access can exploit this vulnerability. The n8n platform is an open-source workflow automation tool commonly deployed as a self-hosted Node.js application (via npm, Docker, or Kubernetes) or accessed through n8n.cloud. It is widely used to integrate databases, API services, AI models, and business applications, making compromised instances a high-value target for lateral movement and data exfiltration. The attack vector involves crafting a malicious JavaScript expression enclosed in {{ }} syntax within any workflow node parameter (such as a Set node, Function node, or HTTP Request node). The expression exploits insufficient sandbox isolation in n8n's expression evaluation engine by accessing the Node.js process object via the 'this' context within an immediately-invoked function expression (IIFE), e.g., {{ (function(){ return this.process.mainModule.require('child_process').execSync('id').toString() })() }}. This sandbox escape technique leverages JavaScript prototype chain climbing through this.constructor.constructor to obtain the host's Function constructor, then loads child_process to execute arbitrary OS commands with the privileges of the n8n process. The vulnerability was discovered by security researchers fatihhcelik and yuvalo1212, publicly disclosed on December 19, 2025, and CISA added it to the KEV catalog on March 11, 2026 after Akamai SIRT confirmed active exploitation by the Zerobot (Mirai variant) botnet in January 2026. Over 103,000 internet-facing n8n instances were identified as potentially vulnerable. The CVSS 9.9 critical severity reflects the ease of exploitation (low complexity, low privileges required) and the full impact on confidentiality, integrity, and availability with scope change to subsequent systems. agent

DeliveryAn authenticated attacker POSTs to /rest/workflows to create a workflow containing a Set node with a malicious n8n expression (prefixed with '=') that escapes the sandbox via this.constructor.constructor('return require("child_process").execSync("<cmd>").toString()')() or this.process.mainModule.require('child_process').execSync(). The attacker then POSTs to /rest/workflows/{id}/run to trigger expression evaluation. The Metasploit module uses a Schedule Trigger node for automated firing. Expression output is returned in the workflow execution response, allowing data exfiltration.

Public PoCyes

PoC URLs https://github.com/n8n-io/n8n/security/advisories/GHSA-v98v-ff95-f3cp
https://github.com/TheStingR/CVE-2025-68613-POC
https://github.com/wioui/n8n-CVE-2025-68613-exploit
https://github.com/r4j3sh-com/CVE-2025-68613-n8n-lab
https://raw.githubusercontent.com/rapid7/metasploit-framework/eae97b314a77efba2498543f0953b14e5cc17c1c/modules/exploits/multi/http/n8n_workflow_expression_rce.rb
https://github.com/vulhub/vulhub/commit/28f45d70f2bfe10e477b34ea078cbc42108588b7
https://github.com/Ak-cybe/CVE-2025-68613-n8n-rce-analysis Third-party repos; verify before use.

Advisoryhttps://github.com/n8n-io/n8n/security/advisories/GHSA-v98v-ff95-f3cp

Exploit notesCVSS attack complexity: LOW. Multiple public PoCs confirm exploitation: TheStingR/CVE-2025-68613-POC (Python exploit + Nuclei template, 28 stars), rapid7 Metasploit module (modules/exploits/multi/http/n8n_workflow_expression_rce.rb), and vulhub/docker-lab setups. The exploit requires only low-privilege authenticated access (any user with workflow creation permissions). The sandbox escape uses this.constructor.constructor() to climb the prototype chain and reach Node.js require(), then loads child_process for OS command execution. Confirmed exploited in the wild by Zerobot/Mirai botnet (Akamai SIRT, January 2026). Over 103,000 internet-facing n8n instances identified as potentially vulnerable.

SummaryCVE-2025-68613 is a critical (CVSS 9.9) remote code execution vulnerability in n8n workflow automation platform (versions 0.211.0 to 1.120.3, 1.121.0, and 1.121.x), where the expression evaluation sandbox fails to properly isolate user-supplied JavaScript expressions from the underlying Node.js runtime, allowing authenticated attackers to escape via prototype chain climbing and execute arbitrary system commands. First publicly disclosed on December 19, 2025, the vulnerability was confirmed actively exploited in the wild by the Zerobot botnet in January 2026, leading to CISA KEV inclusion on March 11, 2026, with over 103,000 internet-facing vulnerable instances identified.

Tia coverage

First reported2026-08-01

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

unit-42-hacker-uses-deepseek-open-source-ai-agent-for-fully-auto

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.