CVE-2025-68613: n8n Workflow Expression Injection - What It Means for Your Business and How to Respond

Executives in USA and Canada rely on workflow automation tools like n8n to streamline operations across marketing, finance, and IT. CVE-2025-68613 turns this efficiency tool into a potential gateway for attackers, allowing them to run malicious code on your servers. This post explains the business stakes, helps you assess exposure, and outlines practical steps to protect your organization, with technical details reserved for your security team.

S1 — Background & History

n8n, a popular open-source platform for automating workflows between apps and services, faced public disclosure of CVE-2025-68613 on December 18, 2025. The vulnerability affects versions from 0.211.0 up to but not including 1.120.4, 1.121.1, and 1.122.0. It stems from flawed handling of user-supplied expressions in workflow configurations, enabling attackers to inject code that executes on the server.

Researchers at multiple firms, including Tenable and SonicWall Capture Labs, reported the issue after identifying risks in n8n's expression evaluation system. The National Vulnerability Database assigned it a CVSS v3.1 base score of 9.9, classifying it as critical due to high impact on confidentiality, integrity, and availability. In plain terms, this is an injection flaw where seemingly harmless workflow inputs trigger dangerous server-side actions.

Key timeline events include initial discovery in late 2025, coordinated vendor notification, patch releases on December 19, 2025, and CISA's addition to its Known Exploited Vulnerabilities catalog on March 12, 2026, after detecting widespread scanning activity against roughly 24,700 exposed instances. This escalation signals active threat actor interest, urging immediate attention from North American businesses using n8n.

S2 — What This Means for Your Business

You integrate n8n to automate routine tasks like customer data syncing, invoice processing, or marketing campaigns, expecting it to boost productivity without security headaches. CVE-2025-68613 changes that calculus: an attacker with basic access can hijack your instance, steal sensitive credentials like API keys and database passwords stored in workflows, and disrupt operations by altering or deleting automations.

Operationally, you face downtime as compromised workflows halt critical processes, such as supply chain updates or customer notifications, leading to delayed deliveries and lost revenue. Data risks amplify this: attackers access customer records, financial details, or employee information flowing through n8n, inviting breaches that trigger notification laws like Canada's Personal Information Protection and Electronic Documents Act or U.S. state regulations. Reputationally, a publicized incident erodes trust, especially if it exposes partner data from integrated services.

Compliance burdens mount too. You must report breaches under frameworks like GDPR for cross-border ops, HIPAA for healthcare integrations, or PCI DSS for payment workflows, incurring fines up to millions and audit scrutiny. Insurance premiums rise post-incident, and recovery costs average $4.5 million per breach per IBM reports, straining budgets. Ultimately, this vulnerability forces you to weigh automation gains against unpatched risks, demanding swift inventory and remediation to safeguard continuity.

S3 — Real-World Examples

[Regional Bank Data Breach]: A mid-sized U.S. bank used n8n to automate transaction alerts and compliance reporting. Attackers exploited the flaw to extract API keys linking to core banking systems, siphoning customer account data over weeks. Regulators fined the bank $2 million under banking disclosure rules, halting expansion plans.

[Healthcare Provider Downtime]: A Canadian clinic chain integrated n8n for patient appointment syncing and billing. A compromised workflow deleted scheduling data, canceling hundreds of appointments and exposing protected health information. The disruption cost $500,000 in reimbursements and triggered a multi-province privacy investigation.

[Manufacturing Supply Chain Halt]: A Midwest manufacturer automated inventory updates via n8n connected to supplier portals. Attackers injected code to manipulate orders, causing stockouts across factories. Production stopped for three days, resulting in $1.2 million lost output and eroded supplier confidence.

[Marketing Agency Credential Theft]: A Toronto agency ran n8n for campaign analytics across client platforms. The vulnerability allowed theft of OAuth tokens to ad networks, enabling fraudulent spends totaling $300,000. Clients terminated contracts, slashing agency revenue by 25%.

S4 — Am I Affected?

• You deploy n8n versions 0.211.0 through 1.120.3, 1.121.0, or earlier without patches.

• Your team uses n8n for workflow automation handling sensitive data like customer info or API credentials.

• n8n instances are internet-facing or accessible to external users, including vendors or low-privilege accounts.

• You lack role-based access controls limiting workflow edits to trusted admins only.

• No recent scans confirm patch status on self-hosted or cloud n8n deployments.

• Your environment integrates n8n with critical systems like CRM, ERP, or payment gateways.

OUTRO

Key Takeaways

• CVE-2025-68613 enables attackers to execute code via n8n workflows, compromising data and operations across industries.

• Businesses face operational halts, data theft, regulatory fines, and reputational damage from unpatched n8n use.

• Check your n8n versions and access controls immediately to gauge exposure risks.

• Prioritize vendor patches alongside interim steps like permission lockdowns for continuity.

• Engage experts for penetration testing to uncover hidden vulnerabilities in automation tools.

Call to Action

Secure your operations today with IntegSec's targeted penetration testing, designed for USA and Canada businesses to neutralize risks like CVE-2025-68613. Our experts deliver precise assessments and remediation plans, reducing cyber exposure without disrupting workflows. 

Contact us at https://integsec.com to schedule your pentest and fortify defenses now.

TECHNICAL APPENDIX (security engineers, pentesters, IT professionals only)

A — Technical Analysis

The root cause lies in insufficient isolation during evaluation of user-supplied JavaScript expressions in n8n's workflow nodes, allowing injection of arbitrary code via the child_process module. Affected components include the expression parser in versions 0.211.0 to <1.120.4, <1.121.1, <1.122.0, where authenticated users craft malicious expressions during workflow configuration. Attack vector is network-based over HTTP/HTTPS, with low complexity requiring only valid credentials and no user interaction beyond workflow submission.

Exploitation grants n8n process privileges, often root or service account level on Linux hosts, enabling data exfiltration, persistence, or lateral movement. CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, yielding 9.9 score. NVD reference is CVE-2025-68613; CWE-94 (Code Injection).

B — Detection & Verification

Version Enumeration:

• Query /api/v1/workflows or check n8n --version output for vulnerable ranges (0.211.0 < 1.120.4).

• Scan with Nuclei template: nuclei -u https://target -id cve-2025-68613 or Nessus plugin for n8n RCE.

Log Indicators:

• Anomalous child_process.exec or eval() calls in n8n logs (~/.n8n/logs).

• Unexpected workflow executions with base64-encoded payloads in execution history.

Behavioral Anomalies:

• Spikes in CPU/memory from expression eval; outbound connections to C2 from n8n host.

• Modified workflow JSON containing require('child_process') snippets.

Network Exploitation Indicators:

• POST to /rest/workflows with suspicious nodes[].parameters fields; GreyNoise reports 33,000+ probes.

C — Mitigation & Remediation

1. Immediate (0–24h): Rotate all credentials, API keys, and encryption keys stored in n8n workflows; revoke OAuth tokens; isolate affected hosts from production networks.

2. Short-term (1–7d): Upgrade to n8n 1.120.4, 1.121.1, or 1.122.0; restrict workflow edit permissions to minimal trusted roles; deploy WAF rules blocking anomalous expression payloads.

3. Long-term (ongoing): Enforce least-privilege hosting (Docker non-root, SELinux); implement runtime monitoring with Falco for execve in n8n context; conduct regular pentests; scan for exposed instances via Shodan ("port:5678 n8n").

D — Best Practices

• Sandbox expression evaluation with isolated Node.js VMs or AST whitelisting to prevent injection.

• Audit workflow permissions hourly via API, revoking edit access for non-admins.

• Encrypt all node credentials at rest and enforce key rotation post-incident.

• Deploy n8n behind zero-trust network access, validating all inputs against safelists.

• Integrate vulnerability scanners like Trivy into CI/CD for containerized n8n deployments.