n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4, 1.121.1, and 1.122.0 contain a critical Remote Code Execution (RCE) vulnerability in their workflow expression evaluation system. Under certain conditions, expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime. An authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations. This issue has been fixed in versions 1.120.4, 1.121.1, and 1.122.0. Users are strongly advised to upgrade to a patched version, which introduces additional safeguards to restrict expression evaluation. If upgrading is not immediately possible, administrators should consider the following temporary mitigations: Limit workflow creation and editing permissions to fully trusted users only; and/or deploy n8n in a hardened environment with restricted operating system privileges and network access to reduce the impact of potential exploitation. These workarounds do not fully eliminate the risk and should only be used as short-term measures.

Code execution is possible in some conditions. Immediate updating of the n8n automation platform is recommended.

According to its banner, the version of n8n running on the remote host is 0.211.0 or later and before 1.120.4 or 1.121.x < 1.121.1. It is, therefore, affected by an Expression Language Injection which can leads to remote code execution.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of the n8n Node.js Package installed on the remote host is 0.211.0 prior to 1.120.4, or 1.121.0. It is, therefore, affected by a remote code execution vis expression injection vulnerability:

  - n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4, 1.121.1,     and 1.122.0 contain a critical Remote Code Execution (RCE) vulnerability in their workflow expression evaluation     system. Under certain conditions, expressions supplied by authenticated users during workflow configuration may be     evaluated in an execution context that is not sufficiently isolated from the underlying runtime. An authenticated     attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful     exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data,     modification of workflows, and execution of system-level operations. (CVE-2025-68613)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4,
    1.121.1, and 1.122.0 contain a critical Remote Code Execution (RCE) vulnerability in their workflow
    expression evaluation system. Under certain conditions, expressions supplied by authenticated users during
    workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the
    underlying runtime. An authenticated attacker could abuse this behavior to execute arbitrary code with the
    privileges of the n8n process. Successful exploitation may lead to full compromise of the affected
    instance, including unauthorized access to sensitive data, modification of workflows, and execution of
    system-level operations. This issue has been fixed in versions 1.120.4, 1.121.1, and 1.122.0. Users are
    strongly advised to upgrade to a patched version, which introduces additional safeguards to restrict
    expression evaluation. If upgrading is not immediately possible, administrators should consider the
    following temporary mitigations: Limit workflow creation and editing permissions to fully trusted users
    only; and/or deploy n8n in a hardened environment with restricted operating system privileges and network
    access to reduce the impact of potential exploitation. These workarounds do not fully eliminate the risk
    and should only be used as short-term measures. (CVE-2025-68613)

ID	Name	Product	Family	Severity
115172	N8n 0.211.0 < 1.120.4 Remote Code Execution	Web App Scanning	Artificial Intelligence	high
115171	N8n 1.121.0 < 1.121.1 Remote Code Execution	Web App Scanning	Artificial Intelligence	high
279637	n8n Node.js Package 0.211.0 < 1.120.4 / 1.121.0 Remote Code Execution via Expression Injection (CVE-2025-68613)	Nessus	Misc.	high
436476	SCA: security update for n8n (GHSA-v98v-ff95-f3cp)	Tenable Cloud Security	SCA Checks	high
436476	SCA: security update for n8n (GHSA-v98v-ff95-f3cp)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2025-68613

high

Tenable Plugins

high

high

high

high

high