Analysis-And-POC-N8N-CVE-2025

##

**n8n** is a workflow automation platform used to integrate systems and services through visual flows and JavaScript expressions.

**CVE-2025-68613** is a **critical Remote Code Execution (RCE)** vulnerability, with **CVSS 9.9** , affecting multiple versions of n8n. The flaw occurs in the processing of JavaScript expressions in workflows in vulnerable versions that are not properly isolated. This allows **authenticated users with edit permissions to execute code outside the application's expected behavior**.

In practice, this flaw can be exploited to run commands on the server where n8n is running, using the application's own privileges. Affected versions range from **0.211.0** up to versions prior to the fixes applied in **1.120.4** , **1.121.1** and **1.122.0**.

![n8n](

* Exposure of credentials, SSH keys, environment variables and integration tokens.

This repository documents **CVE-2025-68613** technically, covering the context of the flaw, affected versions, exploitation and recommended mitigation measures.

![n8n in hunter](

❌ Affected| >= 0.211.0| Introduction of the vulnerable mechanism

❌ Affected| = 1.122.0| Fix incorporated by default

> It is recommended to update immediately to version **1.122.0 or higher**.

To demonstrate the vulnerability, the following conditions are required:

* n8n instance running a vulnerable version

* Write permissions (creation or editing of workflows)

> The flaw occurs **during creation and execution of workflows** , not before authentication.

### Step 1 — Authentication on the Platform

The first step is to log in to the n8n web interface with a valid user.

![n8n login screen](

> This step confirms the attack is not anonymous. The vulnerability requires an authenticated user.

After logging in, verify that the user has permissions to create and edit workflows.

![User management screen](

> This is relevant because only users with this access level can insert dynamic expressions into workflows.

With the authenticated user, create a new workflow from scratch.

![Initial screen for creating a workflow](

> Here begins the legitimate use of n8n functionality that, in vulnerable versions, can be exploited.

The first node added to the workflow is the Manual Trigger.

![Adding the Manual Trigger](

**What this node does:** Allows manual execution of the workflow, used as the starting point of the flow.

> In this scenario, it only serves as an entry point for workflow execution.

### Step 5 — Adding the _Edit Fields (Set)_ Node

The second node added is the Edit Fields (Set).

![Adding the Edit Fields \(Set\) node](

**What this node does:** This node allows creating, modifying or overwriting data fields within the workflow. It accepts static values or JavaScript expressions evaluated at execution time.

> It is precisely at this point that the vulnerability manifests.

### Step 6 — Inserting the Vulnerable Expression

Inside the value field of the Edit Fields (Set) node, insert a JavaScript expression wrapped by `{{ }}`, which is the format used by n8n to evaluate dynamic expressions.

![Expression field with payload](

* `(function(){ ... })()`: Defines a self-invoking function, allowing encapsulation of all logic and returning a value directly to the workflow expression.

* `this.process`: Accesses the internal Node.js `process` object, which exposes runtime information and resources.

* `process.mainModule`: Allows access to the application's main module, enabling loading of other internal Node.js modules.

* `require('child_process')`: Native Node.js module that allows creating new processes on the operating system and executing external commands.

* `execSync('id')`: Executes a command directly on the operating system where n8n is running, using the application's process privileges.

* `.toString()`: Converts the executed command's output to text, allowing the result to be displayed in the n8n interface.

The displayed result confirms that the command was executed on the operating system using the n8n process privileges, characterizing a Remote Code Execution (RCE).

*

*

*

*