Alex Joseph
The world of workflow automation is incredibly powerful, allowing businesses to streamline complex processes. n8n stands out as a popular open-source platform in this space. However, a recently identified security flaw, cataloged as CVE-2025-68697, highlights the importance of keeping software up-to-date and configured securely, especially for self-hosted instances.
This vulnerability affects self-hosted n8n instances where the “Code node” operates in its older JavaScript execution mode. Essentially, this flaw could allow an authenticated user who has permission to edit workflows to access and manipulate files on the server where n8n is installed. Imagine a scenario where a user, with what seems like limited workflow editing rights, could potentially read sensitive configuration files or even write malicious scripts to the server. This could lead to unauthorized data access, system disruption, or further compromise of the server. The ability to perform actions with the same privileges as the running n8n process makes this a significant concern.
CVE Details
This vulnerability is officially identified as CVE-2025-68697. It was publicly disclosed on December 26, 2025. The issue has been classified with a HIGH severity level.
Affected Products
The core product impacted is n8n, specifically versions released before 2.0.0. The risk is present in self-hosted n8n installations configured to use the legacy (non-task-runner) JavaScript execution mode for the Code node. If your n8n setup matches these criteria, it’s crucial to take immediate action.
Current Status
As of now, this vulnerability has been thoroughly analyzed. The good news is that a patch is readily available, and practical workarounds have also been identified to help protect your systems if an immediate upgrade isn’t feasible.
Severity Level
With a CVSS score of 7.1, CVE-2025-68697 is categorized as a High severity vulnerability. A “High” rating indicates that the flaw could have a significant impact on the confidentiality, integrity, or availability of your system. In this case, it means unauthorized users could potentially gain control over files on your n8n host, which could lead to data breaches, system instability, or even a complete compromise of the underlying server if not addressed promptly.
Possible Solutions
The most effective way to address CVE-2025-68697 is to upgrade your n8n instance to version 2.0.0 or a later release. The developers have released a patch in this version specifically to mitigate this vulnerability.
If an immediate upgrade is not possible, several workarounds can help reduce your exposure:
- Restrict File Access: Configure the `N8N_RESTRICT_FILE_ACCESS_TO` environment variable. By setting this to a dedicated directory (e.g., `~/.n8n-files`), you limit where n8n can perform file operations, significantly reducing the scope of potential damage. Ensure this dedicated directory does not contain any sensitive information.
- Block Access to n8n Internal Files: Keep `N8N_BLOCK_FILE_ACCESS_TO_N8N_FILES=true`. This is the default setting and helps prevent access to critical `.n8n` and user-defined configuration files, adding another layer of defense.
- Disable High-Risk Nodes: If you operate in an environment where not all workflow editors are fully trusted, consider disabling high-risk nodes, including the Code node itself, using the `NODES_EXCLUDE` environment variable. This prevents the execution of arbitrary code through these nodes.
Implementing these solutions will significantly enhance the security posture of your n8n environment against this specific vulnerability.
References
https://github.com/n8n-io/n8n/security/advisories/GHSA-j4p8-h8mh-rh8q
