AI Threat Alert
CVE-2025-68697
MEDIUMIf your organization runs self-hosted n8n for AI workflow automation and hasn't upgraded to v2.0.0, any authenticated workflow editor can read or write arbitrary files on the host with the process's OS privileges — including API keys, credentials, and AI model configs. Patch to v2.0.0 immediately; if you can't patch today, restrict file access via N8N_RESTRICT_FILE_ACCESS_TO and disable the Code node for untrusted editors. This is particularly dangerous in AI agent pipelines where n8n orchestrates LLM calls and holds API credentials for multiple AI services.
Affected Systems
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| n8n | npm | — | No patch |
Do you use n8n? You're affected.
Severity & Risk
Recommended Action
- 1. PATCH: Upgrade n8n to v2.0.0+ which introduces task-runner mode isolating code execution. 2. IMMEDIATE WORKAROUND: Set N8N_RESTRICT_FILE_ACCESS_TO=~/.n8n-files (or equivalent empty sandbox dir) to limit filesystem access. 3. Verify N8N_BLOCK_FILE_ACCESS_TO_N8N_FILES=true is set (it is by default — do not override). 4. If workflow editors are not fully trusted: add Code node to NODES_EXCLUDE env var to disable it entirely. 5. DETECTION: Audit n8n workflow logs for Code nodes invoking fs, path, or process internal modules; alert on unexpected file read/write patterns in n8n process logs. 6. Rotate any API keys or credentials stored on n8n hosts if the instance was exposed to untrusted workflow editors before patching.
Classification
Compliance Impact
This CVE is relevant to:
Technical Details
NVD Description
n8n is an open source workflow automation platform. Prior to version 2.0.0, in self-hosted n8n instances where the Code node runs in legacy (non-task-runner) JavaScript execution mode, authenticated users with workflow editing access can invoke internal helper functions from within the Code node. This allows a workflow editor to perform actions on the n8n host with the same privileges as the n8n process, including: reading files from the host filesystem (subject to any file-access restrictions configured on the instance and OS/container permissions), and writing files to the host filesystem (subject to the same restrictions). This issue has been patched in version 2.0.0. Workarounds for this issue involve limiting file operations by setting N8N_RESTRICT_FILE_ACCESS_TO to a dedicated directory (e.g., ~/.n8n-files) and ensure it contains no sensitive data, keeping N8N_BLOCK_FILE_ACCESS_TO_N8N_FILES=true (default) to block access to .n8n and user-defined config files, and disabling high-risk nodes (including the Code node) using NODES_EXCLUDE if workflow editors are not fully trusted.
Exploitation Scenario
A threat actor with legitimate n8n workflow editor access (e.g., a contractor, a compromised team account) opens the Code node in a workflow and crafts JavaScript that calls internal n8n helper functions to enumerate and read /home/n8n/.n8n/config, /etc/environment, or application .env files. Within seconds they extract API keys for OpenAI, Stripe, and cloud providers stored on the host. Alternatively, they write a malicious script to the host filesystem (e.g., a cron job or startup hook) that beacons out to an attacker-controlled server, establishing persistence. In an AI agent pipeline context, they could also modify prompt templates or tool definitions to inject instructions into downstream LLM calls — achieving indirect prompt injection at the infrastructure level.
Weaknesses (CWE)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N