Critical n8n Flaw (CVSS 9.9) Enables Arbitrary Code Execution Across Thousands of Instances

A critical security flaw has been disclosed in the n8n workflow automation platform that could allow arbitrary code execution under certain conditions, tracked as CVE-2025-68613 with a CVSS of 9.9. The issue affects all versions including and higher than 0.211.0 and below 1.120.4, and has been patched in versions 1.120.4, 1.121.1 and 1.122.0. According to Censys, there are 103,476 potentially vulnerable instances as of 22 December 2025, with a majority located in the U.S., Germany, France, Brazil and Singapore.

The npm package has about 57,000 weekly downloads, and an authenticated attacker could abuse workflow configuration expressions to execute code with the privileges of the n8n process, potentially leading to full compromise of the affected instance and access to sensitive data. In light of the severity, users are advised to apply the updates as soon as possible, or otherwise limit workflow creation and editing permissions and operate n8n in a hardened environment with restricted OS privileges and network access.