Critical n8n flaw could enable arbitrary code execution

A critical flaw in the n8n automation platform could allow an authenticated attacker to execute arbitrary code under specific conditions, with CVE-2025-68613 carrying a CVSS score of 9.9. The advisory notes that the package gets about 57,000 downloads per week, according to npm statistics, and that successful exploitation could lead to full compromise of the affected instance, including data access and modification of workflows.

The vulnerability resides in n8n’s workflow expression evaluation system, where expressions supplied by authenticated users may be evaluated in an execution context not sufficiently isolated from the runtime. It has been fixed in versions 1.120.4, 1.121.1, and 1.122.0, and users are strongly urged to upgrade; if upgrading isn’t possible, administrators should restrict workflow creation and editing to fully trusted users and run n8n in a hardened environment. Cybersecurity firm Censys observed 103,476 potentially vulnerable instances as of December 22, 2025, most located in the U.S., Germany and France.