CVE-2025-68613 — AI Deep Analysis Summary

🚨 **Essence**: n8n Workflow Automation has a critical isolation flaw in its expression evaluation system. 💥 **Consequences**: Attackers can achieve **Remote Code Execution (RCE)**, completely compromising the server.…

🛡️ **Root Cause**: **CWE-913** (Overly Complex System). The isolation between the workflow expression evaluator and the host environment is insufficient. ⚠️ It allows malicious expressions to break out of their sandbox.

📦 **Affected Versions**: • 0.211.0 to 1.120.4 • 1.121.1 • 1.122.0 (and earlier) 🏢 **Vendor**: n8n-io. If you use these versions, you are in the danger zone! 🎯

🔓 **Attacker Power**: Full **RCE**! 🖥️ Hackers can execute arbitrary commands on the server. They can steal data, install backdoors, or pivot to other internal systems.…

🔑 **Exploitation Threshold**: **Low**. • **Network**: Remote (AV:N) • **Complexity**: Low (AC:L) • **Auth**: Requires Low Privileges (PR:L) - likely a valid user account. • **UI**: No interaction needed (UI:N).…

💣 **Public Exploits**: **YES**. Multiple PoCs are live on GitHub (e.g., rxerium, Ashwesker, TheStingR). Wild exploitation is highly likely. 🌍 The community has already released scanners and full exploits.

🔍 **Self-Check**: 1. Check your n8n version immediately! 📝 2. Use the provided GitHub PoC scanners to detect vulnerability. 🔎 3. Look for unusual workflow expressions or unexpected server processes. 👀

🩹 **Official Fix**: **YES**. Patches are available via GitHub commits (e.g., 39a2d1d, 08f3320). 🛠️ Check the GitHub Security Advisory (GHSA-v98v-ff95-f3cp) for the specific fixed version. Update ASAP!

🚧 **No Patch?**: • **Isolate**: Restrict network access to n8n instances. 🚫 • **Disable**: Turn off workflow expression evaluation if possible. ⛔ • **Monitor**: Watch for suspicious command executions.…

🚨 **Urgency**: **CRITICAL (Priority 1)**. CVSS Score is effectively **10.0** (Critical). With public exploits available, immediate patching is mandatory. Don't wait! ⏳💨