.
This repository does **not** provide exploitation
* A structured, professional scanning workflow
CVE-2025-68613 originates from inadequate sandboxing inside the expression engine used during workflow execution.
A malicious authenticated user may bypass expression isolation and reach underlying runtime objects, potentially enabling system-level actions.
Misconfigured or publicly exposed n8n instances increase the risk dramatically.
This PoC is **safe** and **non-destructive**. It validates:
From `GET /signin`, using Base64-encoded metadata.
Matches version against known vulnerable ranges.
Calls `/rest/settings`, which in vulnerable deployments returns:
Exposing such internal values indicates weakened isolation, a key requirement for the vulnerability.
1. Authenticated workflow editors can insert expressions.
2. Vulnerable versions evaluate expressions in unsafe contexts.
4. Attackers can escalate expression evaluation into runtime evaluation.
python3 cve-2025-68613.py -u -p 443 --insecure
[✓] Target is NOT vulnerable. No further action required.
If the scanner detects a vulnerable version, the PoC automatically proceeds:
python cve-2025-68613.py -u 127.0.0.1 -p 443 --poc -v -k
python cve-2025-68613.py -u 127.0.0.1 -p 443 --poc -v -k
------------------------------------------
[DEBUG] Fetching:
[•] Running SAFE PoC to validate exposure...
[DEBUG] Querying settings:
The instance exposes internal configuration without authentication.
This correlates with weakened backend isolation seen in vulnerable builds.
--- Metadata Fragment (Pretty Printed) ---
"instanceId": "ab12eeb1234d5a12ee12c123caa86aca12345fc1234567fbc3e29b6e12f123cd",
"oauth1": "
"oauth2": "
"callbackUrl": "
"loginUrl": "
"proxy": "
"sourceConfig": "
"endpoint": "
"infoUrl": "
"whatsNewEndpoint": "
* Restrict workflow creation to trusted users
* Avoid exposing n8n directly to the Internet
python3 cve-2025-68613.py -u -p 5678 --poc --insecure
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
