n8n Node.js Package 0.211.0 < 1.120.4 / 1.121.0 Remote Code Execution via Expression Injection (CVE-2025-68613)

Language:

Version 1.4 Mar 12, 2026, 10:32 AM CISA reference Plugin Feed: 202603121032
Version 1.3 Feb 20, 2026, 9:10 AM CVSS metrics ("CVSSv3 score" set to 8.8) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H") CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:F/RL:OF/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:F/RL:O/RC:C") Exploit attributes ("Exploit available" set to "True") Exploit attributes ("Exploit framework metasploit" set to "True") Exploit attributes ("Exploitability ease" set to "Exploits are available") Plugin Feed: 202602200910
Version 1.2 Jan 13, 2026, 2:35 AM New Plugin Feed: 202601130235
Version 1.1 Dec 23, 2025, 10:46 PM New Plugin Feed: 202512232246

* Changelogs are generally available for changes made after Nov 1, 2022