CVE-2025-68668 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2025-68668 requires immediate attention.

· 3 min read

```html

Executive Summary

A critical vulnerability, CVE-2025-68668, has been identified in the npm package n8n. This sandbox bypass vulnerability allows authenticated users to execute arbitrary commands on the host system running n8n, posing severe risks to solo developers and small teams. Immediate action is required to mitigate potential exploitation.

Immediate Action

  • Upgrade to n8n version 2.0.0 or later to utilize the secure Python task runner.
  • If unable to upgrade immediately, disable the Code Node by setting the environment variable: 
    NODES_EXCLUDE: "[\"n8n-nodes-base.code\"]"
  • Disable Python support in the Code Node by setting the environment variable: 
    N8N_PYTHON_ENABLED=false
  • Configure n8n to use the task runner-based Python sandbox by setting the environment variables: 
    N8N_RUNNERS_ENABLED=true
    N8N_NATIVE_PYTHON_RUNNER=true
  • Consult the n8n documentation for detailed guidance: Blocking access to nodes

Affected Versions

  • n8n@<=1.111.0 vulnerable; upgrade to 2.0.0+

Resolution Guide

Follow these commands to upgrade and configure your n8n environment:

npm install n8n@2.0.0

To disable the Code Node:

export NODES_EXCLUDE="[\"n8n-nodes-base.code\"]"

To disable Python support:

export N8N_PYTHON_ENABLED=false

To enable the task runner-based Python sandbox:

export N8N_RUNNERS_ENABLED=true
export N8N_NATIVE_PYTHON_RUNNER=true

Detection & Verification

To check if your version of n8n is vulnerable, run:

npm list n8n

Verify the fix by checking the version post-upgrade:

npm list n8n

Ensure the environment variables are set correctly by checking:

echo $NODES_EXCLUDE
echo $N8N_PYTHON_ENABLED
echo $N8N_RUNNERS_ENABLED
echo $N8N_NATIVE_PYTHON_RUNNER

Risk and Impact

This vulnerability allows authenticated users to execute arbitrary commands with the same privileges as the n8n process, potentially leading to system compromise. The blast radius includes any system running a vulnerable version of n8n, making it critical for developers to act swiftly to secure their environments.

```

Keep reading