n8n Node.js Package 0.211.0 < 1.120.4 / 1.121.0 Remote Code Execution via Expression Injection (CVE-2025-68613)

critical Nessus Plugin ID 279637

Synopsis

The n8n Node.js Package installed on the remote host is affected by a remote code execution vulnerability.

Description

The version of the n8n Node.js Package installed on the remote host is 0.211.0 prior to 1.120.4, or 1.121.0. It is, therefore, affected by a remote code execution vis expression injection vulnerability:

- n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4, 1.121.1, and 1.122.0 contain a critical Remote Code Execution (RCE) vulnerability in their workflow expression evaluation system. Under certain conditions, expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime. An authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations. (CVE-2025-68613)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to n8n Node.js Package version 1.120.4, 1.121.1, 1.122.0 or later.

Plugin Details

Severity: Critical

ID: 279637

File Name: n8n_nodejs_package_1_122_0.nasl

Version: 1.1

Type: local

Agent: windows, macosx, unix

Family: Misc.

Published: 12/23/2025

Updated: 12/23/2025

Configuration: Enable thorough checks (optional)

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 10.0

CVSS v2

Risk Factor: High

Base Score: 9

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2025-68613

CVSS v3

Risk Factor: Critical

Base Score: 9.9

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Vulnerability Information

CPE: cpe:/a:nodejs:node.js

Required KB Items: Host/nodejs/modules/enumerated

Patch Publication Date: 11/19/2025

Vulnerability Publication Date: 12/19/2025

Reference Information

CVE: CVE-2025-68613

Detections

Analytics