New n8n Vulnerability (9.9 CVSS) Lets Authenticated Users Execute System Commands
Summary: A critical vulnerability in the open-source workflow automation platform n8n, tracked as CVE-2025-68668 and rated 9.9 on CVSS, lets an authenticated user with permission to create or modify workflows execute arbitrary operating system commands on the host running n8n, using the same privileges as the n8n process. The flaw, a sandbox bypass in the Python Code Node that uses Pyodide, affects versions 1.0.0 up to but not including 2.0.0 and was addressed in version 2.0.0, with Cyera Research Labs' Vladimir Tokarev and Ofek Itach credited and the flaw codenamed N8scape.
What you should know: The researchers describe it as a structural problem: n8n blocks a small set of risky functions but does not remove the underlying capabilities, so anyone who can edit a workflow holds the same privileges as the n8n process itself.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-68613CVE-2025-68668
- Related
- CVE-2025-68613: n8n Improper Control of Dynamically-Managed Code Resources Vulnerability Known Exploited Vulnerabilities · Mar 11, 2026