24h | 7d | 30d

CVE-2025-68613

Overview

  • n8n-io
  • n8n
19 Dec 2025
Published
22 Dec 2025
Updated
CVSS v3.1
CRITICAL (10.0)
EPSS
0.22%
KEV

Description

n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4, 1.121.1, and 1.122.0 contain a critical Remote Code Execution (RCE) vulnerability in their workflow expression evaluation system. Under certain conditions, expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime. An authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations. This issue has been fixed in versions 1.120.4, 1.121.1, and 1.122.0. Users are strongly advised to upgrade to a patched version, which introduces additional safeguards to restrict expression evaluation. If upgrading is not immediately possible, administrators should consider the following temporary mitigations: Limit workflow creation and editing permissions to fully trusted users only; and/or deploy n8n in a hardened environment with restricted operating system privileges and network access to reduce the impact of potential exploitation. These workarounds do not fully eliminate the risk and should only be used as short-term measures.

Statistics

  • 9 Posts
  • 5 Interactions
Last activity: 1 hour ago

Fediverse

Profile picture
Miguel Afonso Caetano @remixtures

RT @TheHackersNews
⚠️ ALERT — A critical RCE flaw (CVSS 9.9) was found in the n8n workflow automation platform.

CVE-2025-68613 lets authenticated users execute arbitrary code, enabling full instance takeover, data access, and system-level actions.

More than 103k exposed instances are observed globally.

🔗 Details → thehackernews.com/2025/12/crit

  • 3
  • 0
  • 0
  • 20h ago
Profile picture
:mastodon: decio @decio

si vous utilisez n8n… ⚠️

Une vulnérabilité critique ( CVE-2025-68613 ) permet à un utilisateur connecté de détourner un workflow pour exécuter des commandes sur le serveur qui héberge n8n.

Concrètement, une automatisation mal conçue (ou malveillante) peut sortir du cadre prévu et donner accès au système :

données manipulées par les workflows

modification ou suppression des automatisations

et potentiellement contrôle complet du serveur

La faille touche de nombreuses versions (depuis 0.211.0) et est très sévère, surtout si n8n est exposé à Internet ou utilisé par plusieurs personnes.

✅ Solution : mettre à jour rapidement vers les versions corrigées (≥ 1.120.4 / 1.121.1 / 1.122.0).

En attendant, restreignez au maximum les droits de création/édition des workflows

👉 Si n8n est critique dans votre infra, c’est une priorité de sécurité.

"Remote Code Execution via Expression Injection "
👇
github.com/n8n-io/n8n/security

🔍
⬇️
github.com/rxerium/CVE-2025-68

🔍
⬇️
"n8n CVE-2025-68613 RCE Exploitation: A Detailed Guide"
👇
blog.securelayer7.net/cve-2025

  • 1
  • 0
  • 0
  • 1h ago
Profile picture
nyanbinary @nyanbinary

@cR0w well there WAS this... nvd.nist.gov/vuln/detail/CVE-2

  • 0
  • 1
  • 0
  • 14h ago
Profile picture
Matt Franz @mdfranz

Another 🎁 orca.security/resources/blog/c

  • 0
  • 0
  • 0
  • 13h ago
Profile picture
Cybersecurity & cyberwarfare @cybersecurity

9,9 sulla scala di panico. Una vulnerabilità critica in n8n consente una RCE critica

Una vulnerabilità nella piattaforma di automazione del flusso di lavoro n8n , utilizzata in tutto il mondo, consente agli aggressori di eseguire codice arbitrario da remoto. Il bug, identificato come CVE-2025-68613, ha un punteggio CVSS pari a 9,9 su 10.

In determinate condizioni, consente la compromissione completa del sistema, incluso l’accesso a dati sensibili e la possibilità di modificare script esistenti o eseguire comandi a livello di sistema operativo.

n8n – Secure Workflow Automation for Technical Teams è una piattaforma avanzata di workflow automation progettata per team tecnici che necessitano di automatizzare compiti e processi tra applicazioni, dati e servizi con un elevato grado di controllo, sicurezza e flessibilità.

A differenza di molti strumenti di automazione consumer-oriented, n8n combina una interfaccia visiva drag-and-drop con la possibilità di inserire codice personalizzato (JavaScript o Python) dove necessario, permettendo di costruire flussi di lavoro complessi che integrano API, trigger, condizioni logiche e azioni multi-step. La sua architettura “fair code”, open-source e self-hostable consente alle organizzazioni di mantenere il pieno controllo dei dati e dell’infrastruttura, soddisfacendo al contempo i requisiti di sicurezza e conformità avanzata.

La vulnerabilità si manifesta nel modo in cui n8n elabora le espressioni inserite dagli utenti autorizzati durante la configurazione dei flussi di lavoro. In alcuni casi, queste espressioni possono essere interpretate in un contesto di esecuzione non sufficientemente isolato dall’ambiente principale.

Se sfruttata da un aggressore con accesso al sistema, la vulnerabilità può eseguire codice arbitrario con gli stessi privilegi del processo n8n in esecuzione.

Il problema riguarda tutte le versioni dalla 0.211.0 alla 1.120.3 incluse.

Gli aggiornamenti che correggono la vulnerabilità sono disponibili per le versioni 1.120.4, 1.121.1 e 1.122.0. Secondo Censys, al 22 dicembre erano presenti online oltre 103.000 istanze potenzialmente vulnerabili di n8n. Il numero maggiore si trova negli Stati Uniti, in Germania, Francia, Brasile e Singapore.

Data la criticità della vulnerabilità, si consiglia vivamente agli amministratori di installare le patch il prima possibile. Nei casi in cui non sia possibile un aggiornamento tempestivo, limitare la creazione e la modifica del flusso di lavoro ai soli utenti attendibili ed eseguire n8n in un ambiente isolato con privilegi minimi e restrizioni di accesso alla rete.

L'articolo 9,9 sulla scala di panico. Una vulnerabilità critica in n8n consente una RCE critica proviene da Red Hot Cyber.

  • 0
  • 0
  • 0
  • 15h ago

Bluesky

Profile picture
Checkmarx Zero @checkmarxzero.bsky.social
🚨CVE-2025-68613: Critical RCE in n8n via expression injection. Auth users can craft workflow expressions that escape isolation and execute code as the n8n process risking full instance compromise. Patch: upgrade to v1.122.0+ (1.120.4/1.121.1/1.122.0). More info: devhub.checkmarx.com/cve-details/...
  • 0
  • 0
  • 0
  • 14h ago
Profile picture
Undercode Testing @undercode.bsky.social
Critical n8n Hack: How a Single Workflow Expression Can Let Attackers Seize Your Servers (CVE-2025-68613) + Video Introduction: A critical vulnerability in the n8n workflow automation platform, tracked as CVE-2025-68613, has exposed over 100,000 internet-facing instances to complete server…
  • 0
  • 0
  • 0
  • 8h ago
Profile picture
セキュリティ対策Lab @securitylab-jp.bsky.social
n8nに認証済みユーザーからRCEを許す脆弱性(CVE-2025-68613) rocket-boys.co.jp/security-mea... #セキュリティ対策Lab #セキュリティ #Security #サイバー攻撃
  • 0
  • 0
  • 0
  • 7h ago
Profile picture
nixpkgs security changes @nixpkgssecuritychanges.gerbet.me
[release-25.05] n8n: mark vulnerable to CVE-2025-68613 https://github.com/NixOS/nixpkgs/pull/473821 #security
  • 0
  • 0
  • 0
  • 1h ago

CVE-2025-15047

Overview

  • Tenda
  • WH450
23 Dec 2025
Published
23 Dec 2025
Updated
CVSS v4.0
CRITICAL (9.3)
EPSS
Pending
KEV

Description

A vulnerability was found in Tenda WH450 1.0.0.18. This affects an unknown function of the file /goform/PPTPDClient of the component HTTP Request Handler. Performing manipulation of the argument Username results in stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made public and could be used.

Statistics

  • 2 Posts
  • 1 Interaction
Last activity: 5 hours ago

Fediverse

Profile picture
Santa Caws @cR0w

Tenda

cve.org/CVERecord?id=CVE-2025-

cc: @Dio9sys @da_667

  • 0
  • 1
  • 0
  • 13h ago
Profile picture
Offensive Sequence @offseq

⚠️ CRITICAL: Tenda WH450 (v1.0.0.18) suffers a stack-based buffer overflow (CVE-2025-15047) in /goform/PPTPDClient. Public exploit exists! Isolate devices, restrict endpoint access, and monitor for attacks. No patch yet. radar.offseq.com/threat/cve-20

  • 0
  • 0
  • 0
  • 5h ago

CVE-2025-50165

Overview

  • Microsoft
  • Windows Server 2025 (Server Core installation)
12 Aug 2025
Published
21 Nov 2025
Updated
CVSS v3.1
CRITICAL (9.8)
EPSS
3.84%
KEV

Description

Untrusted pointer dereference in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.

Statistics

  • 2 Posts
Last activity: 20 hours ago

Fediverse

Profile picture
Dragster Systems @Dragster_Systems

Revisión de CVE-2025-50165: Un fallo crítico en Windows Imaging Component

Vía: @ESET

welivesecurity.com/es/investig

  • 0
  • 0
  • 0
  • 20h ago

Bluesky

Profile picture
Dragster Systems @dragstersystems.bsky.social
Revisión de CVE-2025-50165: Un fallo crítico en Windows Imaging Component Vía: @esetofficial.bsky.social www.welivesecurity.com/es/investiga...
  • 0
  • 0
  • 0
  • 20h ago

CVE-2025-66211

Overview

  • coollabsio
  • coolify
23 Dec 2025
Published
23 Dec 2025
Updated
CVSS v4.0
CRITICAL (9.4)
EPSS
Pending
KEV

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in PostgreSQL Init Script Filename handling allows users with application/service management permissions to execute arbitrary commands as root on managed servers. PostgreSQL initialization script filenames are passed to shell commands without proper validation, enabling full remote code execution. Version 4.0.0-beta.451 fixes the issue.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 3 hours ago

Fediverse

Profile picture
Offensive Sequence @offseq

🔴 CVE-2025-66211: CRITICAL Coolify OS command injection bug (pre-4.0.0-beta.451) lets authenticated users run root commands via PostgreSQL script filenames. Patch urgently! radar.offseq.com/threat/cve-20

  • 1
  • 0
  • 0
  • 3h ago

CVE-2025-66209

Overview

  • coollabsio
  • coolify
23 Dec 2025
Published
23 Dec 2025
Updated
CVSS v4.0
CRITICAL (9.4)
EPSS
Pending
KEV

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the Database Backup functionality allows users with application/service management permissions to execute arbitrary commands as root on managed servers. Database names used in backup operations are passed directly to shell commands without sanitization, enabling full remote code execution. Version 4.0.0-beta.451 fixes the issue.

Statistics

  • 1 Post
  • 4 Interactions
Last activity: 14 hours ago

Fediverse

Profile picture
Santa Caws @cR0w

Hey @pft here's another one for your rule:

github.com/0xrakan/coolify-cve

Per the write-up, it's five perfect 10s in Coolify. 🥳

  • 0
  • 4
  • 0
  • 14h ago

CVE-2025-15048

Overview

  • Tenda
  • WH450
23 Dec 2025
Published
23 Dec 2025
Updated
CVSS v4.0
MEDIUM (6.9)
EPSS
Pending
KEV

Description

A vulnerability was determined in Tenda WH450 1.0.0.18. This impacts an unknown function of the file /goform/CheckTools of the component HTTP Request Handler. Executing manipulation of the argument ipaddress can lead to command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

Statistics

  • 1 Post
  • 2 Interactions
Last activity: 13 hours ago

Fediverse

Profile picture
Santa Caws @cR0w

Tenda

cve.org/CVERecord?id=CVE-2025-

cc: @Dio9sys @da_667

  • 0
  • 2
  • 0
  • 13h ago

CVE-2025-15044

Overview

  • Tenda
  • WH450
23 Dec 2025
Published
23 Dec 2025
Updated
CVSS v4.0
CRITICAL (9.3)
EPSS
Pending
KEV

Description

A vulnerability was detected in Tenda WH450 1.0.0.18. Impacted is an unknown function of the file /goform/NatStaticSetting. The manipulation of the argument page results in stack-based buffer overflow. The attack may be performed from remote. The exploit is now public and may be used.

Statistics

  • 1 Post
  • 2 Interactions
Last activity: 15 hours ago

Fediverse

Profile picture
Santa Caws @cR0w

Tenda

cve.org/CVERecord?id=CVE-2025-

cc: @Dio9sys @da_667

  • 0
  • 2
  • 0
  • 15h ago

CVE-2025-63666

Overview

  • Pending
12 Nov 2025
Published
18 Nov 2025
Updated
CVSS
Pending
EPSS
0.07%
KEV

Description

Tenda AC15 v15.03.05.18_multi) issues an authentication cookie that exposes the account password hash to the client and uses a short, low-entropy suffix as the session identifier. An attacker with network access or the ability to run JS in a victim browser can steal the cookie and replay it to access protected resources.

Statistics

  • 1 Post
  • 2 Interactions
Last activity: 14 hours ago

Fediverse

Profile picture
Santa Caws @cR0w

IDK if I shared this dumb Tenda one already or not:

github.com/Remenis/CVE-2025-63

I know this sort of thing used to be fairly common but it's weird seeing it in a 2025 CVE.

  • 0
  • 2
  • 0
  • 14h ago

CVE-2025-15046

Overview

  • Tenda
  • WH450
23 Dec 2025
Published
23 Dec 2025
Updated
CVSS v4.0
CRITICAL (9.3)
EPSS
Pending
KEV

Description

A vulnerability has been found in Tenda WH450 1.0.0.18. The impacted element is an unknown function of the file /goform/PPTPClient of the component HTTP Request Handler. Such manipulation of the argument netmsk leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 14 hours ago

Fediverse

Profile picture
Santa Caws @cR0w

Tenda

cve.org/CVERecord?id=CVE-2025-

cc: @Dio9sys @da_667

  • 0
  • 1
  • 0
  • 14h ago

CVE-2025-34352

Overview

  • JumpCloud Inc.
  • Remote Assist
02 Dec 2025
Published
02 Dec 2025
Updated
CVSS v4.0
HIGH (8.5)
EPSS
0.02%
KEV

Description

JumpCloud Remote Assist for Windows versions prior to 0.317.0 include an uninstaller that is invoked by the JumpCloud Windows Agent as NT AUTHORITY\SYSTEM during agent uninstall or update operations. The Remote Assist uninstaller performs privileged create, write, execute, and delete actions on predictable files inside a user-writable %TEMP% subdirectory without validating that the directory is trusted or resetting its ACLs when it already exists. A local, low-privileged attacker can pre-create the directory with weak permissions and leverage mount-point or symbolic-link redirection to (a) coerce arbitrary file writes to protected locations, leading to denial of service (e.g., by overwriting sensitive system files), or (b) win a race to redirect DeleteFileW() to attacker-chosen targets, enabling arbitrary file or folder deletion and local privilege escalation to SYSTEM. This issue is fixed in JumpCloud Remote Assist 0.317.0 and affects Windows systems where Remote Assist is installed and managed through the Agent lifecycle.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 4 hours ago

Bluesky

Profile picture
Eyal Estrin ☁️ @eyalestrin.bsky.social
JUMPSHOT: XM Cyber Uncovers Critical Local Privilege Escalation (CVE-2025-34352) in JumpCloud Agent #appsec
  • 0
  • 1
  • 0
  • 4h ago
Showing 1 to 10 of 58 CVEs