CVE-2025-68668: Arbitrary Command Execution in n8n Python Code Node

CVE-2025-68668 is a newly disclosed vulnerability in n8n that affects the Python Code Node and has drawn attention for its severity. It impacts all n8n versions from 1.0.0 up to, but not including, 2.0.0, with the issue fully addressed starting from version 2.0.0, where a more secure execution model is used by default.

The vulnerability allows certain authenticated users to escape the Pyodide-based sandbox and run arbitrary operating system commands on the server, with commands executing with the same privileges as the n8n process. Mitigations include disabling the Code Node via the NODES_EXCLUDE environment variable, disabling Python support in the Code Node by setting N8N_PYTHON_ENABLED=false, and enabling the secure, task runner–based Python sandbox using N8N_RUNNERS_ENABLED and N8N_NATIVE_PYTHON_RUNNER, according to SOCRadar.

The advisory also notes that exploitation requires authenticated access and can be launched remotely over the network. This context underscores the value of continuous threat intelligence in tracking CVEs and prioritising remediation, as SOCRadar’s Threat Intelligence module and ASM tools help organisations understand exposure and plan upgrades. according to SOCRadar