Non-members are welcome to access the full story here.
Here i want to share about my write-up for the room n8n: CVE-2025–68613 ↗ , Learn how adversaries can exploit the CVE-2025–68613 vulnerability in n8n. Hope it is useful for learning about cybersecurity.
Press enter or click to view image in full size
Task 1: Introduction
CVE-2025–68613 is a critical vulnerability (CVSS 9.9) in the n8n workflow automation platform, published in December 2025. This vulnerability is a Remote Code Execution (RCE) flaw found in the workflow expression evaluation system, affecting versions 0.211.0 through 1.120.3. It allows authenticated attackers to execute system-level commands by injecting malicious JavaScript code. Users are strongly advised to update to patched versions (1.120.4, 1.121.1, or 1.122.0) to secure their instances.
Let’s dive into the technical details.
No answer needed
Task 2: Technical Background
n8n is built on Node.js and uses an Expression Evaluation System to process dynamic user input wrapped in {{ }}. The vulnerability exists because this system lacks proper sandboxing. An attacker can escape the intended context by using this to access the global Node.js object. The exploit chain typically involves accessing…