{
 "public_id": "AIR-2025-0196",
 "incident_id": "2025-12-n8n-expression-injection-rce",
 "date_disclosed": "2025-12-19",
 "date_occurred": null,
 "title": "CVE-2025-68613: n8n workflow expression injection RCE, added to CISA KEV after in-the-wild exploitation",
 "class": "in_the_wild",
 "attack_surface": "agent_framework",
 "initial_vector": "authenticated_workflow_expression",
 "agent_capability_abused": [
  "workflow_expression_evaluation",
  "code_node_execution"
 ],
 "target_product": "n8n workflow automation / AI agent platform",
 "target_vendor": "n8n GmbH",
 "autonomy_level": "semi_autonomous",
 "impact_realized": true,
 "impact_type": [
  "remote_code_execution",
  "full_host_compromise"
 ],
 "blast_radius": "n8n >= 0.211.0; 24,607 instances still unpatched as of 2026-02-05 per ShadowServer; Censys counted 100,000+ potentially vulnerable in Dec 2025",
 "cve": [
  "CVE-2025-68613"
 ],
 "taxonomy": {
  "owasp_asi": [
   "ASI05"
  ],
  "mitre_atlas": [],
  "labels": [
   "sandbox_escape",
   "expression_injection",
   "exploited_in_the_wild",
   "cisa_kev",
   "agent_builder"
  ]
 },
 "defense_present": "expression evaluation sandbox intended to isolate user expressions from the Node.js runtime",
 "defense_bypassed": true,
 "fix_shipped": "n8n 1.120.4, 1.121.1, 1.122.0 (December 2025)",
 "primary_sources": [
  "https://github.com/n8n-io/n8n/security/advisories/GHSA-v98v-ff95-f3cp",
  "https://thehackernews.com/2026/03/cisa-flags-actively-exploited-n8n-rce.html"
 ],
 "verified_quote": "n8n contains a critical Remote Code Execution (RCE) vulnerability in its workflow expression evaluation system. Under certain conditions, expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime.",
 "confidence": "high",
 "notes": "GHSA-v98v-ff95-f3cp. CVSS 9.9 per n8n, 8.8 per NVD. Added to CISA Known Exploited Vulnerabilities catalog 2026-03-11 with a 2026-03-25 FCEB remediation deadline - the first n8n entry in KEV. Related later n8n flaws: CVE-2026-21858 'Ni8mare' (CVSS 10.0, Rapid7) and CVE-2026-27577 (CVSS 9.4, Pillar Security); those are separate disclosure events and are not merged here.",
 "risk_category": "security_fraud",
 "risk_secondary": [],
 "risk_subcategory": "Remote Code Execution & Sandbox Escape",
 "risk_sub_secondary": [],
 "ai_entity": "generative",
 "agency": "ai_as_target",
 "agency_debatable": false,
 "agency_reason": "workflow expression injection RCE in n8n, exploited in the wild",
 "vector_family": "other",
 "vector_detail": "authenticated_workflow_expression",
 "guardrail_kind": [
  "sandbox_isolation"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [
   "CVE-2025-68613"
  ],
  "ghsa": []
 },
 "primary_asi": "ASI05",
 "agent_framework": "n8n",
 "model_provider": "unknown",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "privilege_escalation",
 "eai_domain": "access_control_and_permissions",
 "eai_secondary": [],
 "eai_reason": "subcategory: Remote Code Execution & Sandbox Escape",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI05 (impact=code_exec)",
 "submitted_by": "EAI Internal"
}