n8n Workflow Expression Evaluation Remote Code Execution (RCE) Vulnerability Advisory (CVE-2025-68613)

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2025-68613) is a critical Remote Code Execution (RCE) flaw residing in the workflow expression evaluation engine of n8n, an open-source workflow automation platform. n8n allows users to write JavaScript-like expressions to manipulate data dynamically within workflows. However, in affected versions, expressions supplied by authenticated users are evaluated in an execution context that lacks proper isolation from the underlying Node.js runtime (CWE-913). This sandbox escape vulnerability allows arbitrary code to break out of the intended execution boundaries.

2. Exploitation Mechanics & Attack Scenario

An authenticated attacker with permissions to create or edit workflows can exploit this vulnerability by injecting malicious JavaScript payloads into workflow node configuration expressions. When the n8n engine evaluates these expressions—either during manual execution, testing, or automated triggers—the payload executes within the context of the main n8n process. Because the context is not sufficiently sandboxed, the attacker can access Node.js core modules (such as 'child_process') to execute arbitrary shell commands on the host OS or container. This vulnerability is actively exploited in the wild (listed in CISA KEV) by threat actors, including campaigns deploying Zerobot malware to compromise automation servers.

3. Infrastructure & Business Impact

Since n8n is heavily integrated into enterprise environments to automate critical business logic, database operations, and API integrations, a successful compromise has severe consequences. Attackers can extract sensitive credentials, API tokens, and secrets stored within n8n. Furthermore, it provides an initial foothold inside the network, enabling lateral movement, data exfiltration, and deployment of ransomware or botnet agents.