CVE-2025-68668: n8n Protection Bypass circumvents

CISO Take

If your organization runs n8n for AI workflow automation, this is a drop-everything-and-patch situation. Any authenticated user with workflow edit access can execute arbitrary OS commands on your n8n host — full server compromise via a single malicious Python Code Node. Patch to 2.0.0 immediately; if you cannot, set N8N_PYTHON_ENABLED=false as an interim workaround and audit who holds workflow modification permissions.

What is the risk?

Critical risk. CVSS 9.9 reflects network-accessible, low-complexity, low-privilege exploitation with full C/I/A impact across scope boundaries. n8n is increasingly deployed as the orchestration backbone for AI agent pipelines, meaning a compromised n8n host cascades to all connected LLM APIs, databases, and downstream SaaS integrations. The low privilege requirement makes this broadly exploitable — any standard user account suffices, not just admins. No active KEV listing yet, but the low barrier to exploitation makes weaponization highly probable.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	—	No patch
193.4K OpenSSF 6.6 Pushed 2d ago 55% patched ~7d to patch Full package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

9.9 / 10

EPSS

9.2%

chance of exploitation in 30 days

Higher than 95% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Changed

C High

I High

A High

What should I do?

7 steps

IMMEDIATE

Upgrade to n8n 2.0.0.
If immediate patching is blocked: set environment variable N8N_PYTHON_ENABLED=false (available since 1.104.0) — disables Python while preserving JavaScript Code Nodes.
If full Code Node must be disabled: set NODES_EXCLUDE=["n8n-nodes-base.code"].
Longer term: enable the task-runner-based Python sandbox via N8N_RUNNERS_ENABLED=true and N8N_NATIVE_PYTHON_RUNNER=true env vars (architectural isolation rather than process-level sandbox).
Apply least-privilege on workflow permissions — audit who can create or modify workflows and remove unnecessary access.
Search audit logs for Code Node executions containing subprocess, os.system, exec, eval, or network calls outside expected patterns.
If compromise is suspected: rotate all API keys and credentials stored in n8n connections immediately.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Agent Framework Plugin AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0083 - Credentials from AI Agent Configuration AML.T0105 - Escape to Host

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 9 - Risk Management System Article 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.2.6 - AI System Security A.8.4 - Testing of AI Systems A.9.3 - AI System Security

NIST AI RMF

GOVERN 1.4 - Organizational teams are committed to a culture that considers and communicates AI risk GOVERN 1.7 - Processes and Procedures for AI Risk Management MANAGE 2.2 - Mechanisms are in place to inventory AI risks and to manage risk response

OWASP LLM Top 10

LLM07 - Insecure Plugin Design LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2025-68668?

If your organization runs n8n for AI workflow automation, this is a drop-everything-and-patch situation. Any authenticated user with workflow edit access can execute arbitrary OS commands on your n8n host — full server compromise via a single malicious Python Code Node. Patch to 2.0.0 immediately; if you cannot, set N8N_PYTHON_ENABLED=false as an interim workaround and audit who holds workflow modification permissions.

Is CVE-2025-68668 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2025-68668, increasing the risk of exploitation.

How to fix CVE-2025-68668?

1. IMMEDIATE: Upgrade to n8n 2.0.0. 2. If immediate patching is blocked: set environment variable N8N_PYTHON_ENABLED=false (available since 1.104.0) — disables Python while preserving JavaScript Code Nodes. 3. If full Code Node must be disabled: set NODES_EXCLUDE=["n8n-nodes-base.code"]. 4. Longer term: enable the task-runner-based Python sandbox via N8N_RUNNERS_ENABLED=true and N8N_NATIVE_PYTHON_RUNNER=true env vars (architectural isolation rather than process-level sandbox). 5. Apply least-privilege on workflow permissions — audit who can create or modify workflows and remove unnecessary access. 6. Search audit logs for Code Node executions containing subprocess, os.system, exec, eval, or network calls outside expected patterns. 7. If compromise is suspected: rotate all API keys and credentials stored in n8n connections immediately.

What systems are affected by CVE-2025-68668?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI workflow automation pipelines, LLM integration pipelines, no-code/low-code AI builders, multi-tool AI orchestration platforms.

What is the CVSS score for CVE-2025-68668?

CVE-2025-68668 has a CVSS v3.1 base score of 9.9 (CRITICAL). The EPSS exploitation probability is 9.19%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI workflow automation pipelinesLLM integration pipelinesno-code/low-code AI buildersmulti-tool AI orchestration platforms

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0083 Credentials from AI Agent Configuration

AML.T0105 Escape to Host

Compliance Controls Affected

EU AI Act: Art. 9, Article 15

ISO 42001: A.6.2.6, A.8.4, A.9.3

NIST AI RMF: GOVERN 1.4, GOVERN 1.7, MANAGE 2.2

OWASP LLM Top 10: LLM07, LLM08

What are the technical details?

Original Advisory

n8n is an open source workflow automation platform. From version 1.0.0 to before 2.0.0, a sandbox bypass vulnerability exists in the Python Code Node that uses Pyodide. An authenticated user with permission to create or modify workflows can exploit this vulnerability to execute arbitrary commands on the host system running n8n, using the same privileges as the n8n process. This issue has been patched in version 2.0.0. Workarounds for this issue involve disabling the Code Node by setting the environment variable NODES_EXCLUDE: "[\"n8n-nodes-base.code\"]", disabling Python support in the Code node by setting the environment variable N8N_PYTHON_ENABLED=false, which was introduced in n8n version 1.104.0, and configuring n8n to use the task runner based Python sandbox via the N8N_RUNNERS_ENABLED and N8N_NATIVE_PYTHON_RUNNER environment variables.

Exploitation Scenario

An attacker with a valid n8n user account — obtained via phishing, credential stuffing, or insider access — creates or modifies an existing workflow containing a Python Code Node. They craft Python code that exploits the Pyodide sandbox's protection mechanism failure (CWE-693) to break out of the WebAssembly-based isolation layer. Once escaped, arbitrary OS commands execute with the same privileges as the n8n process, which in typical deployments runs with broad or root-level access. The attacker reads environment variables to harvest LLM API keys, database credentials, and webhook secrets; establishes a reverse shell for persistent access; and pivots laterally to connected AI services and internal infrastructure. The entire attack requires no elevated n8n permissions and no user interaction beyond the attacker's own session.

Weaknesses (CWE)

CWE-693 Protection Mechanism Failure

CWE-693 — Protection Mechanism Failure: The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Source: MITRE CWE corpus.