AI Threat Alert
CVE-2025-68668
CRITICALIf your organization runs n8n for AI workflow automation, this is a drop-everything-and-patch situation. Any authenticated user with workflow edit access can execute arbitrary OS commands on your n8n host — full server compromise via a single malicious Python Code Node. Patch to 2.0.0 immediately; if you cannot, set N8N_PYTHON_ENABLED=false as an interim workaround and audit who holds workflow modification permissions.
Affected Systems
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| n8n | npm | — | No patch |
Do you use n8n? You're affected.
Severity & Risk
Recommended Action
- 1. IMMEDIATE: Upgrade to n8n 2.0.0. 2. If immediate patching is blocked: set environment variable N8N_PYTHON_ENABLED=false (available since 1.104.0) — disables Python while preserving JavaScript Code Nodes. 3. If full Code Node must be disabled: set NODES_EXCLUDE=["n8n-nodes-base.code"]. 4. Longer term: enable the task-runner-based Python sandbox via N8N_RUNNERS_ENABLED=true and N8N_NATIVE_PYTHON_RUNNER=true env vars (architectural isolation rather than process-level sandbox). 5. Apply least-privilege on workflow permissions — audit who can create or modify workflows and remove unnecessary access. 6. Search audit logs for Code Node executions containing subprocess, os.system, exec, eval, or network calls outside expected patterns. 7. If compromise is suspected: rotate all API keys and credentials stored in n8n connections immediately.
Classification
Compliance Impact
This CVE is relevant to:
Technical Details
NVD Description
n8n is an open source workflow automation platform. From version 1.0.0 to before 2.0.0, a sandbox bypass vulnerability exists in the Python Code Node that uses Pyodide. An authenticated user with permission to create or modify workflows can exploit this vulnerability to execute arbitrary commands on the host system running n8n, using the same privileges as the n8n process. This issue has been patched in version 2.0.0. Workarounds for this issue involve disabling the Code Node by setting the environment variable NODES_EXCLUDE: "[\"n8n-nodes-base.code\"]", disabling Python support in the Code node by setting the environment variable N8N_PYTHON_ENABLED=false, which was introduced in n8n version 1.104.0, and configuring n8n to use the task runner based Python sandbox via the N8N_RUNNERS_ENABLED and N8N_NATIVE_PYTHON_RUNNER environment variables.
Exploitation Scenario
An attacker with a valid n8n user account — obtained via phishing, credential stuffing, or insider access — creates or modifies an existing workflow containing a Python Code Node. They craft Python code that exploits the Pyodide sandbox's protection mechanism failure (CWE-693) to break out of the WebAssembly-based isolation layer. Once escaped, arbitrary OS commands execute with the same privileges as the n8n process, which in typical deployments runs with broad or root-level access. The attacker reads environment variables to harvest LLM API keys, database credentials, and webhook secrets; establishes a reverse shell for persistent access; and pivots laterally to connected AI services and internal infrastructure. The entire attack requires no elevated n8n permissions and no user interaction beyond the attacker's own session.
Weaknesses (CWE)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H