CVE-2025-68613: n8n workflow expression evaluation RCE for authenticated users

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityRemote code execution with low attack complexity, active exploitation per KEV and third-party reporting, and an EPSS probability above 0.99 make this an urgent patch.

What it is

n8n versions from 0.211.0 before 1.120.4, 1.121.1, and 1.122.0 evaluate user-supplied workflow expressions in an execution context that is not sufficiently isolated from the underlying runtime. An authenticated user who can create or edit workflows can therefore execute arbitrary code as the n8n process. Because n8n commonly holds credentials and integrations, compromise of the instance exposes sensitive data and connected systems.

Impact

An attacker with a valid account gains remote code execution with the privileges of the n8n process, leading to full instance compromise: theft of stored credentials and data, workflow tampering, and system-level operations on the host.

Attack surface

Reached over the network through the workflow expression evaluation feature; the CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates low complexity, required low-privileged authentication, and no user interaction. Only users permitted to create or edit workflows can supply the malicious expression.

Exploitation

CISA added this to KEV on 2026-03-11 with a 2026-03-25 remediation due date, and EPSS is 0.99105 (99.9th percentile). A third-party advisory reference is tagged Exploit and describes Zerobot malware targeting n8n, indicating active exploitation in the wild.

What to do

• Upgrade to n8n 1.120.4, 1.121.1, or 1.122.0, which add safeguards restricting expression evaluation.
• If immediate upgrade is impossible, restrict workflow creation and editing permissions to fully trusted users only.
• Run n8n with least-privilege OS accounts and restrict its network access to reduce blast radius.
• Rotate credentials and secrets stored in n8n after any suspected compromise, since the process can read them.
• Treat internet-exposed n8n instances as urgent: apply the vendor fix or take them offline until patched.

Detection

• Audit n8n logs for workflow creation or edits by unexpected accounts, especially expressions containing code-like or system-call patterns.
• Monitor the n8n process for child processes, shell execution, or outbound connections that do not match normal workflow behavior.
• Alert on new or modified workflows that invoke expression evaluation shortly after account creation or privilege changes.
• Hunt for indicators associated with Zerobot malware on hosts running n8n, per the referenced third-party research.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.