CVE-2025-68613: n8n Remote Code Execution Vulnerability
Summary
CVE-2025-68613: n8n Vulnerable to Remote Code Execution via Expression Injection. Affects n8n across 2 version ranges.
>= 0.211.0, < 1.120.4
>= 1.121.0, < 1.121.1
Fixed in 1.120.4 or 1.121.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
n8n is an open-source workflow automation tool that allows users to connect various applications and services to automate tasks. It provides a user-friendly interface for creating workflows using a visual editor. However, n8n has a critical vulnerability in its expression evaluation system, which can lead to remote code execution if exploited by an authenticated user.
Vulnerability Detail
The vulnerability arises from the insufficient isolation of the execution context in which user-supplied expressions are evaluated during workflow configuration. This flaw allows an authenticated attacker to execute arbitrary code with the privileges of the n8n process. The potential ramifications include unauthorized access to sensitive data, modification of workflows, and execution of system-level operations, leading to a full compromise of the affected instance.
How To Fix
Latest published version: 2.44.6 as of 22 Oct 2026
npm install n8n@2.44.6Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 0.211.0, < 1.120.41.120.4npm install n8n@1.120.4 -
>= 1.121.0, < 1.121.11.121.1npm install n8n@1.121.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, administrators can implement the following temporary mitigations: 1. Limit workflow creation and editing permissions to fully trusted users only. 2. Deploy n8n in a hardened environment with restricted operating system privileges and network access to minimize the impact of potential exploitation.
Conclusion
The n8n Remote Code Execution vulnerability (CVE-2025-68613) poses a significant risk to users of the platform. It is crucial for affected users to upgrade to the patched version 1.122.0 or later to mitigate this risk. Temporary workarounds can be implemented, but they do not fully eliminate the threat.
See every vulnerability recorded for n8n →
FAQ
The CVSS score of this vulnerability is 9.9, indicating a critical level of severity.
Any instance of n8n version 0.211.0 to 1.121.1 is affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot upgrade immediately, limit workflow permissions to trusted users and deploy n8n in a secure environment as temporary mitigations.
Successful exploitation may lead to unauthorized access to sensitive data, modification of workflows, and execution of system-level operations, resulting in full compromise of the n8n instance.
References
Related vulnerabilities
Recent vulnerabilities recorded for n8n.
