n8n Workflow Expression Injection RCE
- Product
- n8n n8n
- CVE
- CVE-2025-68613
- Disclosed
- 2025-12-19
- CVSS
- 9.9
- Auth
- requires auth / interaction
- CISA KEV
- yes
- Affected
- n8n >= 0.211.0, < 1.120.4; 1.121.0
- Fixed
- 1.120.4, 1.121.1, 1.122.0
Summary
n8n, a popular workflow automation platform, evaluated {{ }} expressions in a JavaScript context that was not isolated from Node.js. Any logged-in user who could edit workflows could run system commands. It was added to CISA KEV in March 2026.
Root cause
Workflow expressions were evaluated with access to the global 'this' object, from which process.mainModule.require (or constructor chains) could be reached. That allowed loading child_process and executing OS commands with the n8n process's privileges.
Impact
Authenticated remote code execution and access to every credential stored in n8n.
Detection
Search workflow definitions for expressions referencing process, mainModule, require or constructor; Rapid7 Metasploit module n8n_workflow_expression_rce exists. Version check against fixed releases.
Mitigation
Upgrade to 1.120.4, 1.121.1, 1.122.0 or later and restrict workflow-edit rights to trusted users.