Critical New Vulnerability in Automation Platform n8n Allows Arbitrary Command Execution
Published
Key Takeaways
- High-Severity Flaw: A security vulnerability with a CVSS score of 9.9 has been identified in the open-source workflow automation platform n8n.
- Command Execution Risk: The flaw permits an authenticated user to execute arbitrary system commands on the host system running the n8n instance.
- Mitigation: Users are strongly advised to update to the latest version to patch the vulnerability.
A critical security vulnerability has been discovered in n8n, a widely used open-source workflow automation platform. The flaw could allow an authenticated attacker with valid user credentials and the permission to create or modify workflows to execute arbitrary system commands on the host system.
Impact on Workflow Automation Security
The flaw, which has been assigned a Common Vulnerability Scoring System (CVSS) rating of 9.9 out of 10, allows for authenticated command execution on systems running n8n using the same privileges as the n8n process, the advisory said.
This critical vulnerability, tracked as CVE-2025-68668, poses a direct threat to the integrity and confidentiality of any data processed by the automation tool.
Remediation and Security Recommendations
The developers of n8n have released a patch to address the vulnerability. “A sandbox bypass vulnerability exists in the Python Code Node that uses Pyodide,” the advisory said.
“In n8n version 1.111.0, a task-runner-based native Python implementation was introduced as an optional feature, providing a more secure isolation model.” This became the default starting with version 2.0.0.
Suggested workarounds:
- Disable the Code Node by setting the environment variable NODES_EXCLUDE: "[\"n8n-nodes-base.code\"]"
- Disable Python support in the Code node by setting the environment variable N8N_PYTHON_ENABLED=false, which was introduced in n8n version 1.104.0.
- Configure n8n to use the task runner-based Python sandbox via the N8N_RUNNERS_ENABLED and N8N_NATIVE_PYTHON_RUNNER environment variables.
Last month, another critical flaw was disclosed that is now under active exploitation – a MongoDB vulnerability that allows unauthenticated memory access.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Saturday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Saturday.
Most Popular