Alex Joseph
n8n is a powerful open-source platform designed to automate workflows, connecting various applications and services. However, a significant security flaw, identified as CVE-2025-68613, has been discovered in n8n. This critical vulnerability could allow an authenticated attacker to execute malicious code on the system, potentially leading to a complete compromise of your n8n instance and sensitive data.
CVE Details
This critical vulnerability affects n8n, the popular workflow automation platform.
- Product: n8n
- Published: December 19, 2025
- Severity: CRITICAL
- Status: Analyzed
Affected Products
The Remote Code Execution (RCE) vulnerability impacts specific versions of n8n. If you are running n8n versions starting from 0.211.0 and any version prior to 1.120.4, 1.121.1, or 1.122.0, your instance is at risk. This means a wide range of n8n deployments could be vulnerable to exploitation.
Current Status
The vulnerability, CVE-2025-68613, has been thoroughly analyzed by the n8n team and the cybersecurity community. Patches have been released, addressing the core issue. Organizations using affected versions are strongly urged to take immediate action to secure their systems.
Severity Level
Rated as ‘CRITICAL’ with a CVSS score of 9.9, this vulnerability poses a severe threat. A critical rating signifies that the flaw can be exploited with relatively low complexity, leading to widespread and significant damage. Successful exploitation could result in unauthorized access to sensitive information, modification of existing workflows, and the ability to execute system-level commands, putting the entire server at risk.
Possible Solutions
The most effective way to protect your n8n instance from CVE-2025-68613 is to upgrade to a patched version immediately. The n8n team has released fixes in the following versions:
- Version 1.120.4
- Version 1.121.1
- Version 1.122.0
These updated versions introduce stronger safeguards that specifically restrict how workflow expressions are evaluated, closing the door on potential code injection.
If an immediate upgrade is not feasible, consider these temporary mitigation strategies:
- Restrict User Permissions: Limit the ability to create and edit workflows to only the most trusted administrators. This reduces the attack surface by ensuring fewer users can introduce malicious expressions.
- Harden Deployment Environment: Deploy n8n in an isolated environment with minimal operating system privileges and restricted network access. This can help reduce the potential impact if the vulnerability is exploited, though it does not prevent exploitation itself.
Remember, these mitigations are temporary workarounds and do not eliminate the risk entirely. Prioritize upgrading to a patched version as soon as possible.
References
Here are the references related to this vulnerability for further reading:
https://github.com/n8n-io/n8n/commit/08f332015153decdda3c37ad4fcb9f7ba13a7c79
https://github.com/n8n-io/n8n/commit/1c933358acef527ff61466e53268b41a04be1000
https://github.com/n8n-io/n8n/commit/39a2d1d60edde89674ca96dcbb3eb076ffff6316
https://github.com/n8n-io/n8n/security/advisories/GHSA-v98v-ff95-f3cp
https://www.akamai.com/blog/security-research/2026/feb/zerobot-malware-targets-n8n-automation-platform
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-68613
