n8n Node.js Package 0.211.0 < 1.120.4 / 1.121.0 Remote Code Execution via Expression Injection (CVE-2025-68613)

high Nessus Plugin ID 279637

Language:

Synopsis

The n8n Node.js Package installed on the remote host is affected by a remote code execution vulnerability.

Description

The version of the n8n Node.js Package installed on the remote host is 0.211.0 prior to 1.120.4, or 1.121.0. It is, therefore, affected by a remote code execution vis expression injection vulnerability:

- n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4, 1.121.1, and 1.122.0 contain a critical Remote Code Execution (RCE) vulnerability in their workflow expression evaluation system. Under certain conditions, expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime. An authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations. (CVE-2025-68613)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to n8n Node.js Package version 1.120.4, 1.121.1, 1.122.0 or later.

Plugin Details

Severity: High

ID: 279637

File Name: n8n_nodejs_package_1_122_0.nasl

Version: 1.3

Type: local

Agent: windows, macosx, unix

Family: Misc.

Published: 12/23/2025

Updated: 2/20/2026

Configuration: Enable thorough checks (optional)

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.6

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2025-68613

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 8.2

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:nodejs:node.js

Required KB Items: Host/nodejs/modules/enumerated

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/19/2025

Vulnerability Publication Date: 12/19/2025

Exploitable With

Metasploit (n8n Workflow Expression Remote Code Execution)

Reference Information

CVE: CVE-2025-68613

Detections

Analytics