In the wild
Realized harm
CVE-2025-68613: n8n workflow expression injection RCE, added to CISA KEV after in-the-wild exploitation
AIR-2025-0196 AIR record · 2025-12-n8n-expression-injection-rce
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
n8n contains a critical Remote Code Execution (RCE) vulnerability in its workflow expression evaluation system. Under certain conditions, expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime.github.com
The record
Disclosed
2025-12-19
Vendor
n8n GmbH
Product
n8n workflow automation / AI agent platform
Risk domain
Access control and permissions › Privilege escalation
System type
Generative model
Who acted
AI was the target — workflow expression injection RCE in n8n, exploited in the wild
Attack surface
Agent framework
Autonomy level
Semi-autonomous
Initial vector
Authenticated workflow expression
Impact type
Remote code execution, Full host compromise
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
n8n >= 0.211.0; 24,607 instances still unpatched as of 2026-02-05 per ShadowServer; Censys counted 100,000+ potentially vulnerable in Dec 2025
Capability abused
Defense & remediation
Recorded defense
expression evaluation sandbox intended to isolate user expressions from the Node.js runtime
Guardrail kinds
Sandbox isolation
Guardrail outcome
Silent
Fix shipped
n8n 1.120.4, 1.121.1, 1.122.0 (December 2025)
Taxonomy & references
Curator notes
GHSA-v98v-ff95-f3cp. CVSS 9.9 per n8n, 8.8 per NVD. Added to CISA Known Exploited Vulnerabilities catalog 2026-03-11 with a 2026-03-25 FCEB remediation deadline - the first n8n entry in KEV. Related later n8n flaws: CVE-2026-21858 'Ni8mare' (CVSS 10.0, Rapid7) and CVE-2026-27577 (CVSS 9.4, Pillar Security); those are separate disclosure events and are not merged here.
Supporting sources
Cite as
Enkrypt AI. "CVE-2025-68613: n8n workflow expression injection RCE, added to CISA KEV after in-the-wild exploitation". AIR, AIR-2025-0196. https://agentincident.vercel.app/i/AIR-2025-0196/ (accessed 2026-10-19).