Just wanted to flag a critical vulnerability that dropped recently for n8n (the workflow automation tool). If you’re running this in your homelab or corporate network, this is a "drop everything and patch" situation.
The Gist: CVE-2025-68613 is a Remote Code Execution (RCE) vulnerability with a CVSS score of 9.9. It affects versions 0.211.0 through 1.120.3.
The Technical TL;DR: The issue is in the Expression Evaluation System. n8n allows you to use {{ }} for dynamic data, which is evaluated as JavaScript. The sandbox implementation had a hole that allows an authenticated user to escape the execution context and access the Node.js global object.
Researchers found you can use an IIFE (Immediately Invoked Function Expression) to bypass the sandbox. The payload looks roughly like this:
JavaScript
{{ (function(){ return this.process.mainModule.require('child_process').execSync('id').toString() })() }}
Because this isn't properly restricted, the expression can climb up to process.mainModule, require child_process, and execute arbitrary system commands (like id, whoami, or worse) with the privileges of the n8n process.
Detection: The tricky part is that n8n’s native logs don't capture the request body where this payload lives. To detect it, you really need to be terminating SSL at a proxy (like Nginx) and logging the $request_body.
Sigma Rule: Look for POST requests to /rest/workflows containing strings like .require('child_process') or .execSync(.
The Fix: Update immediately to one of the patched versions:
-
1.120.4 -
1.121.1 -
1.122.0
I wrote a full write-up on the blog including the exact Nginx config to catch this and the Sigma rules for your SIEM. I also did a video breakdown walking through the exploit chain.
0 comments