Critical n8n Vulnerability CVE-2025-68613 Allows Arbitrary Code Execution
- Securityish
- Threats & Incidents
Quick Summary
A critical vulnerability in the n8n workflow automation platform, tracked as CVE-2025-68613, has been identified, allowing arbitrary code execution. This flaw, with a CVSS score of 9.9, affects all versions from 0.211.0 to below 1.120.4, potentially compromising over 103,000 instances. Users are urged to update to patched versions 1.120.4, 1.121.1, or 1.122.0 to mitigate risks associated with unauthorized access and data manipulation.
The Securityish Brief
The n8n workflow automation platform has disclosed a critical security vulnerability, identified as CVE-2025-68613, which allows for arbitrary code execution. This vulnerability has a high CVSS score of 9.9 out of 10 and affects all versions from 0.211.0 to below 1.120.4. As of December 22, 2025, there are approximately 103,476 potentially vulnerable instances, primarily located in the U.S., Germany, France, Brazil, and Singapore.
The vulnerability arises when expressions provided by authenticated users during workflow configuration are evaluated in an execution context that lacks sufficient isolation from the underlying runtime. This flaw could allow an authenticated attacker to execute arbitrary code with the privileges of the n8n process, leading to full compromise of the affected instance.
Successful exploitation may result in unauthorized access to sensitive data, modification of workflows, and execution of system-level operations. The maintainers of the n8n package have released patches in versions 1.120.4, 1.121.1, and 1.122.0 to address this critical issue.
Why This Matters for Your Security
This vulnerability highlights significant risks associated with workflow automation platforms, particularly when user inputs are not adequately isolated. Organizations using n8n should prioritize applying the latest updates to protect against potential exploitation. Limiting workflow creation and editing permissions to trusted users can also help mitigate risks.
Given the widespread use of n8n, with around 57,000 weekly downloads, the implications of this vulnerability are substantial. Organizations must remain vigilant about their security posture and ensure that their automation tools are properly configured and updated.
- n8n: A workflow automation platform that has a critical vulnerability allowing arbitrary code execution.
- CVE-2025-68613: The identifier for the critical vulnerability affecting n8n.
- CVSS: A scoring system that rates the severity of security vulnerabilities, with this flaw scoring 9.9.
- Patch: Updates released in versions 1.120.4, 1.121.1, and 1.122.0 to fix the vulnerability.
- Authenticated attacker: A user with valid credentials who can exploit the vulnerability to execute arbitrary code.
Key Takeaways
- Update your n8n installation to version 1.120.4, 1.121.1, or 1.122.0 immediately to patch the vulnerability.
- Limit workflow creation and editing permissions to trusted users to reduce the risk of exploitation.
- Deploy n8n in a hardened environment with restricted operating system privileges and network access.
- Regularly monitor for updates and security advisories related to n8n and similar platforms.
- Review your organization’s use of workflow automation tools and assess their security configurations.
Key Terms & Concepts
- CVE-2025-68613: In this article, CVE-2025-68613 refers to a critical vulnerability in the n8n platform that allows arbitrary code execution.
- CVSS: CVSS is a scoring system used to assess the severity of security vulnerabilities, with this flaw rated at 9.9.
- Authenticated attacker: An authenticated attacker is a user with valid credentials who can exploit vulnerabilities to gain unauthorized access.
- Patch: In this context, a patch refers to updates released to fix the critical vulnerability in n8n.
- n8n: n8n is a workflow automation platform that enables users to automate tasks and processes.
Read the original article here: https://thehackernews.com/2025/12/critical-n8n-flaw-cvss-99-enables.html
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
