Critical New Vulnerability in Automation Platform n8n Allows Arbitrary Command Execution

Summarize with:

ChatGPT Claude.ai Google AI Grok Perplexity

Add as preferred source on Google

A critical security vulnerability has been discovered in n8n, a widely used open-source workflow automation platform. The flaw could allow an authenticated attacker with valid user credentials and the permission to create or modify workflows to execute arbitrary system commands on the host system. 

Impact on Workflow Automation Security

The flaw, which has been assigned a Common Vulnerability Scoring System (CVSS) rating of 9.9 out of 10, allows for authenticated command execution on systems running n8n using the same privileges as the n8n process, the advisory said. 

This critical vulnerability, tracked as CVE-2025-68668, poses a direct threat to the integrity and confidentiality of any data processed by the automation tool.

Remediation and Security Recommendations

The developers of n8n have released a patch to address the vulnerability. “A sandbox bypass vulnerability exists in the Python Code Node that uses Pyodide,” the advisory said. 

“In n8n version 1.111.0, a task-runner-based native Python implementation was introduced as an optional feature, providing a more secure isolation model.” This became the default starting with version 2.0.0.

Suggested workarounds:

• Disable the Code Node by setting the environment variable NODES_EXCLUDE: "[\"n8n-nodes-base.code\"]" 
• Disable Python support in the Code node by setting the environment variable N8N_PYTHON_ENABLED=false, which was introduced in n8n version 1.104.0.
• Configure n8n to use the task runner-based Python sandbox via the N8N_RUNNERS_ENABLED and N8N_NATIVE_PYTHON_RUNNER environment variables.

Last month, another critical flaw was disclosed that is now under active exploitation – a MongoDB vulnerability that allows unauthenticated memory access.

Related

Commonwealth Bank in Australia Deploys Custom AI Threat Hunter

INTERPOL Warns of Escalating Global Financial Fraud Threat, with AI-Enhanced Scams Four Times More Profitable

Sophisticated Phishing Campaign Exploits Trusted Cisco Domains, Impersonates JPMorgan, Targeting European Security Vendor

EU Sanctions Iranian and Chinese Firms for Cyberattacks Against European Networks

AWS Bedrock Sandbox Vulnerability Allows DNS bypass, No Patch Available

Divine Skins Data Breach Exposes Data of Over 105,000 League of Legends Custom Skins Users, Anonymous Allegedly Behind It

Your Weekly Cybersecurity Briefing

Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.

Subscribe for Free

Please enter a valid email address.

Most Popular

Commonwealth Bank in Australia Deploys Custom AI Threat Hunter

INTERPOL Warns of Escalating Global Financial Fraud Threat, with AI-Enhanced Scams Four Times More Profitable

Sophisticated Phishing Campaign Exploits Trusted Cisco Domains, Impersonates JPMorgan, Targeting European Security Vendor

EU Sanctions Iranian and Chinese Firms for Cyberattacks Against European Networks

AWS Bedrock Sandbox Vulnerability Allows DNS bypass, No Patch Available

Divine Skins Data Breach Exposes Data of Over 105,000 League of Legends Custom Skins Users, Anonymous Allegedly Behind It

Commonwealth Bank in Australia Deploys Custom AI Threat Hunter

INTERPOL Warns of Escalating Global Financial Fraud Threat, with AI-Enhanced Scams Four Times More Profitable

Sophisticated Phishing Campaign Exploits Trusted Cisco Domains, Impersonates JPMorgan, Targeting European Security Vendor

EU Sanctions Iranian and Chinese Firms for Cyberattacks Against European Networks

AWS Bedrock Sandbox Vulnerability Allows DNS bypass, No Patch Available

Divine Skins Data Breach Exposes Data of Over 105,000 League of Legends Custom Skins Users, Anonymous Allegedly Behind It