CVE-2025-68613: 
NixOS vulnerability analysis and mitigation

CVE-2025-68613 is a critical Remote Code Execution (RCE) vulnerability in n8n, an open-source workflow automation platform, caused by insufficient isolation in the workflow expression evaluation system. It affects versions starting from 0.211.0 up to (but not including) 1.120.4, and version 1.121.0 up to (but not including) 1.121.1. The vulnerability was disclosed on December 19, 2025, and patched in versions 1.120.4, 1.121.1, and 1.122.0. It carries a CVSS v3.1 base score of 9.9 (Critical) per the GitHub Advisory, with some sources citing a CVSS 10.0 score under a scope-changed vector (GitHub Advisory, n8n Security Advisory).

The root cause is classified as CWE-913 (Improper Control of Dynamically-Managed Code Resources). The vulnerability exists because n8n's expression evaluator — built on the @n8n/tournament library — failed to properly isolate function expressions from the Node.js global runtime. Specifically, regular JavaScript function expressions used within workflow expressions (e.g., IIFEs or callbacks) could bind this to the Node.js global object, exposing process.env and other sensitive runtime properties. The fix introduced a FunctionThisSanitizer AST hook that rewrites function expressions to bind this to an empty context object ({ process: {} }), and also blocked access to dangerous properties like mainModule, binding, and _load (GitHub Commit 08f3320, GitHub Advisory). Exploitation requires only low-privilege authenticated access (e.g., a user account with workflow creation or editing rights), and no user interaction is needed beyond crafting a malicious expression.

Successful exploitation allows an authenticated attacker to execute arbitrary code with the privileges of the n8n process, leading to full compromise of the affected instance. This includes unauthorized access to sensitive data (including environment variables such as API keys and credentials stored in process.env), modification of workflows, and execution of arbitrary system-level operations. Given n8n's role as a workflow automation hub often connected to databases, APIs, and cloud services, exploitation can enable significant lateral movement into connected systems and data exfiltration. At peak exposure, over 103,000 n8n instances were identified as potentially vulnerable, with approximately 24,700 still exposed after CISA's KEV listing (CISA KEV, The Hacker News).

1. Reconnaissance: Use Shodan, Censys, or FOFA to identify internet-exposed n8n instances running versions between 0.211.0 and 1.120.3, or version 1.121.0. Look for the n8n web interface (default port 5678).
2. Authentication: Log in to the n8n instance using any valid low-privilege user account. In some misconfigured or unclaimed instances, default or no credentials may be sufficient.
3. Create or edit a workflow: Navigate to the workflow editor and add or modify a node that supports expression evaluation (e.g., a Set node or Function node).
4. Inject malicious expression: In an expression field (delimited by {{ }}), inject a payload that exploits the unbound this context to access the Node.js global, such as:

   {{ (function(){ return this.process.env.SECRET_KEY })() }}

   or for RCE via require:

   {{ (function(){ return this.process.mainModule.require('child_process').execSync('id').toString() })() }}

5. Execute the workflow: Trigger the workflow execution. The malicious expression is evaluated server-side with the privileges of the n8n process, returning command output or enabling a reverse shell.
6. Establish persistence: Use the RCE to write a web shell, create a cron job, or exfiltrate credentials from process.env for further access to connected services (Rapid7 ETR, SecureLayer7 PoC).

• Network: Unusual outbound connections from the n8n server process to unknown external IPs or C2 infrastructure; scanning activity targeting port 5678 (n8n default) from known threat actor IP ranges; HTTP requests to n8n workflow execution endpoints containing encoded JavaScript function expressions.
• Logs: n8n application logs showing workflow executions with expressions containing this.process, mainModule, require, child_process, or execSync; unexpected errors in expression evaluation logs referencing Node.js internals; access logs showing repeated workflow creation or editing by low-privilege accounts.
• File System: Unexpected new files (web shells, scripts, binaries) written to the n8n installation directory or system temp directories; new cron jobs or scheduled tasks created by the n8n service account; modified workflow JSON files containing obfuscated expressions.
• Process: Unusual child processes spawned by the n8n Node.js process (e.g., sh, bash, curl, wget, python, nc); unexpected network connections initiated by child processes of n8n; evidence of process.env access or child_process module usage in runtime traces.
• Threat Intelligence: ZeroBot botnet C2 infrastructure IPs communicating with n8n servers; indicators associated with MuddyWater APT tooling on n8n hosts (Akamai ZeroBot Report, Intel 471).

Immediate action: Upgrade n8n to version 1.120.4, 1.121.1, or 1.122.0 or later, which introduce the FunctionThisSanitizer AST hook and additional unsafe property blocklist to restrict expression evaluation (GitHub Advisory). CISA has mandated that federal agencies patch this vulnerability under BOD 22-01 (CISA KEV). Temporary workarounds (if immediate patching is not possible):

• Restrict workflow creation and editing permissions to fully trusted users only.
• Deploy n8n in a hardened environment with restricted OS-level privileges (e.g., run as a non-root user with minimal capabilities) and limit network egress from the n8n process.
• Place n8n behind a WAF or network perimeter controls to limit exposure to untrusted users.

These workarounds do not fully eliminate the risk and should only be used as short-term measures (n8n Security Advisory).

The vulnerability generated significant attention across the security community. Rapid7 published a detailed ETR covering CVE-2025-68613 alongside related n8n flaws (dubbed "Ni8mare" and "N8scape"), noting the critical risk to workflow automation environments (Rapid7 ETR). Akamai's security research team published a report confirming ZeroBot malware's active exploitation of the vulnerability against n8n instances (Akamai). BleepingComputer, The Hacker News, The Register, and Heise all covered the CISA KEV listing and active exploitation, with The Hacker News noting over 24,700 instances remained exposed at the time of CISA's alert (BleepingComputer, The Hacker News). The German Federal Office for Information Security (BSI) also issued a security advisory, and Canada's CCCS published an alert. Community discussion on Reddit's r/n8n and r/selfhosted showed widespread concern among self-hosted users, with many urgently seeking patching guidance. VulnCheck published analysis noting that additional related n8n CVEs also warranted KEV inclusion (VulnCheck).