Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2025-68613: n8n workflow engine can execute remote code
CVE-2025-68613 · published 10 months ago · actively exploited
Summary
The n8n automation tool used in GitHub Actions and other deployments can run code it receives from a workflow expression without proper checks. This means an attacker could cause the system to run their own commands, potentially taking control of the server. Update n8n to the latest version or apply the vendor’s patch to stop this behavior.
What to do
- Update GitHub Actions n8n to version 1.120.4.
- Update GitHub Actions n8n to version 1.121.1.
- Update rootio @rootio/n8n to version 1.120.2-root.io.3.
- Update rootio @rootio/n8n-workflow to version 1.117.0-root.io.2.
- Update GitHub Actions n8n to version 1.120.2-aikido.3.
- Update GitHub Actions n8n-workflow to version 1.117.0-aikido.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | GitHub Actions | n8n |
>= 0.211.0, < 1.120.4 >= 1.121.0, < 1.121.1 Fix: upgrade to 1.120.4
|
| – | n8n | n8n |
>= 0.211.0, < 1.120.4 >= 1.121.0, < 1.121.1 1.121.0 cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:* |
| Root:npm | rootio | @rootio/n8n |
< 1.120.2-root.io.3 Fix: upgrade to 1.120.2-root.io.3
|
| Root:npm | rootio | @rootio/n8n-workflow |
< 1.117.0-root.io.2 Fix: upgrade to 1.117.0-root.io.2
|
| Root:npm | GitHub Actions | n8n |
< 1.120.2-aikido.3 Fix: upgrade to 1.120.2-aikido.3
|
| Root:npm | GitHub Actions | n8n-workflow |
< 1.117.0-aikido.2 Fix: upgrade to 1.117.0-aikido.2
|
Original advisory text
n8n Improper Control of Dynamically-Managed Code Resources Vulnerability
n8n contains an improper control of dynamically managed code resources vulnerability in its workflow expression evaluation system that allows for remote code execution.
References
- https://github.com/n8n-io/n8n/security/advisories/GHSA-v98v-ff95-f3cp Vendor Advisory
- https://github.com/advisories/GHSA-v98v-ff95-f3cp
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68613... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-68613 Vendor Advisory
- https://github.com/n8n-io/n8n/commit/08f332015153decdda3c37ad4fcb9f7ba13a7c79 Patch
- https://github.com/n8n-io/n8n/commit/1c933358acef527ff61466e53268b41a04be1000 Patch
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-... URL
- https://www.akamai.com/blog/security-research/2026/feb/zerobot-malware-targets-n... Vendor Advisory
- https://github.com/n8n-io/n8n/commit/39a2d1d60edde89674ca96dcbb3eb076ffff6316 Patch
Internet-facing
3 days
and check for signs of compromise
Internal
14 days
- Known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.9
Critical
Known exploited
Listed in the CISA KEV catalogue - exploitation confirmed in the wild.
99%
chance of attack within 30 days
Type
CWE-913Improper Control of Dynamically-Managed Code Resources
Timeline
Published19 Dec 2025
Updated21 Oct 2026
First seen6 Mar 2026
Sources
GHSA-v98v-ff95-f3cp · GHSA
CVE-2025-68613 · NVD
CVE-2025-68613 · CISA KEV
CVE-2025-68613 · OSV
Track software like this
Free during beta