← fix library

CRITICAL n8n: n8n CVE-2025-68613 — authenticated RCE via expression injection

Why it matters

Anyone with a login on your n8n (even a low-privilege one) can run system commands on your server through a crafted workflow expression. This is being actively exploited in the wild, and your instance's stored credentials are the real target.

Fix it — 3 steps

1. Upgrade now: 1.120.4, 1.121.1, 1.122.0 or later (anything older back to 0.211.0 is vulnerable).
2. Audit your user list: remove accounts that should not have workflow edit rights. The exploit needs any login, not an admin one.
3. Rotate stored credentials if you were running a vulnerable version while exposed: assume workflows and secrets were read.

Verify it’s fixed

curl -s http://YOUR_SERVER_IP:5678/rest/settings | grep -o 'n8n@[0-9.]*'  # must be >= 1.120.4 / 1.121.1 / 1.122.0

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-68613