Skip to content
Sign in
CVE-2025-6861310.0CriticalCWE-913

n8n Improper Control of Dynamically-Managed Code Resources Vulnerability

n8n

Exploited in the wild · in CISA KEV since 11 MarVendor fix available
99.0%probability of exploitation in the next 30 days
99th percentile
050100

Higher than 99% of scored CVEs

10.0CriticalCVSS 3.1
LowCrit.

Federal deadline

CISA KEV · added 11 Mar · catalogue entry

Passed 219 days ago

DescriptionNVD

n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4, 1.121.1, and 1.122.0 contain a critical Remote Code Execution (RCE) vulnerability in their workflow expression evaluation system. Under certain conditions, expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime. An authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations. This issue has been fixed in versions 1.120.4, 1.121.1, and 1.122.0. Users are strongly advised to upgrade to a patched version, which introduces additional safeguards to restrict expression evaluation. If upgrading is not immediately possible, administrators should consider the following temporary mitigations: Limit workflow creation and editing permissions to fully trusted users only; and/or deploy n8n in a hardened environment with restrict

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Coverage7 articles · 5 outlets

First in our coverage: The Hacker News, 5 Feb.

Full timeline
Quiet for 13 weekslast report 30 Jul7 articles5 outlets
5 Feb · The Hacker News first21 Jun6 Aug21 SepNow
  • Thu 5 Feb, 06:46 UTC. The Hacker News, first report. Critical n8n Flaw CVE-2026-25049 Enables System Command Execution via Malicious Workflows. Cites a CVE in CISA KEV.
  • Wed 11 Mar, 18:34 UTC. CISA, its first report on the story. CISA Adds CVE-2025-68613 to Known Exploited Vulnerabilities Catalogue. Cites a CVE in CISA KEV.
  • Wed 11 Mar, 18:38 UTC. CISA. CISA Adds CVE-2025-68613 to Known Exploited Vulnerabilities Catalogue. Cites a CVE in CISA KEV.
  • Thu 12 Mar, 06:04 UTC. The Hacker News. CISA Flags Actively Exploited n8n RCE Bug as 24,700 Instances Remain Exposed. Cites a CVE in CISA KEV.
  • Thu 12 Mar, 10:08 UTC. Security Affairs, its first report on the story. U.S. CISA adds a flaw in n8n to its Known Exploited Vulnerabilities catalog. Cites a CVE in CISA KEV.
  • Fri 13 Mar, 14:37 UTC. SecurityWeek, its first report on the story. In Other News: N8n Flaw Exploited, Slopoly Malware, Interpol Cybercrime Crackdown. Cites a CVE in CISA KEV.
  • Thu 30 Jul, 10:32 UTC. Unit 42, its first report on the story. Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks. Cites a CVE in CISA KEV.
  1. Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks
    Unit 42 · mentions it in passing
  2. In Other News: N8n Flaw Exploited, Slopoly Malware, Interpol Cybercrime Crackdown
    SecurityWeek
  3. U.S. CISA adds a flaw in n8n to its Known Exploited Vulnerabilities catalog
    Security Affairs
  4. CISA Flags Actively Exploited n8n RCE Bug as 24,700 Instances Remain Exposed
    The Hacker News
  5. CISA Adds CVE-2025-68613 to Known Exploited Vulnerabilities Catalogue
    CISA · official notice
  6. CISA Adds CVE-2025-68613 to Known Exploited Vulnerabilities Catalogue
    CISA · official notice
  7. Critical n8n Flaw CVE-2026-25049 Enables System Command Execution via Malicious Workflows
    The Hacker News · first in our coverage · mentions it in passing

New articles also arrive in the RSS feed.

References

CyberSIXTSignal over noise
Updated AboutDevelopersSign in