Remote Code Execution Vulnerability in n8n Automation Platform
CVE-2025-68613

10CRITICAL

Key Information:

Vendor: N8n-io
Status: N8n
Vendor: CVE Published:; 19 December 2025

Badges

🥇 Trended No. 1📈 Trended📈 Score: 38,300👾 Exploit Exists🟡 Public PoC🟣 EPSS 76%🦅 CISA Reported📰 News Worthy

What is CVE-2025-68613?

CVE-2025-68613 is a critical vulnerability identified within the n8n automation platform, an open-source tool designed for creating and automating complex workflows across various applications. This specific vulnerability is categorized as a Remote Code Execution (RCE) flaw and affects versions 0.211.0 through certain releases before 1.120.4, 1.121.1, and 1.122.0. Under certain conditions, expressions inputted by authenticated users during the configuration of workflows can be executed in an insufficiently isolated context, potentially allowing an attacker with valid credentials to execute arbitrary code. The implications of this vulnerability are severe, as it grants attackers the ability to exploit the n8n process's privileges, leading to full compromise of the instance. This can result in unauthorized access to sensitive organizational data, modification of existing workflows, and the capability to perform operations at the system level.

Potential impact of CVE-2025-68613

Full Compromise of Instance: Successful exploitation enables attackers to gain total control of the n8n instance, potentially accessing and manipulating sensitive data stored within the platform.
Unauthorized Workflow Modifications: Attackers could alter existing automation workflows or create malicious workflows, potentially leading to data loss or unintended actions being performed within integrated applications.
System-Level Operations Execution: The capacity to execute arbitrary code could allow attackers to initiate additional malicious software or processes on the server, heightening the risk of further system compromise and data breaches.

CISA has reported CVE-2025-68613

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2025-68613 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

n8n >= 0.211.0, < 1.120.4 < 0.211.0, 1.120.4

n8n = 1.121.0 = 1.121.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

n8n-CVE-2025-68613
Created by LingerANR

n8n-exploit-CVE-2025-68613-n8n-God-Mode-Ultimate
Created by hackersatyamrastogi

POC-CVE-2025-68613
Created by GnuTLam

News Articles

The Hacker News

CVE-2025-68613

CISA Flags Actively Exploited n8n RCE Bug as 24,700 Instances Remain Exposed

CISA adds n8n RCE flaw CVE-2025-68613 to KEV after active exploitation; 24,700 exposed instances raise compromise risk.

1 week ago

BleepingComputer

CVE-2025-68613

CISA orders feds to patch n8n RCE flaw exploited in attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered government agencies on Wednesday to patch their systems against an actively exploited n8n vulnerability.

2 weeks ago