External risk intelligence

n8n Python Code Node Sandbox Bypass Allows Host Command Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2025-68668

n8n is a workflow automation platform frequently deployed as a web-accessible service or API gateway to integrate various internet-based applications. While exploitation requires authenticated access, the platform itself is commonly exposed to the internet to facilitate its primary function of connecting external web services and endpoints.

N8n

1.0.0 to before 2.0.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in n8n, an open-source workflow automation platform. The issue, present in versions 1.0.0 up to, but not including, 2.0.0, allows authenticated users to execute arbitrary commands on the host system by bypassing the Python Code Node's sandbox. This could have significant implications for systems running n8n, as the executed commands would run with the same privileges as the n8n process itself.

An authenticated user can run any command.
Critical flaw in workflow automation software.
Confirm if your automation platform is affected.

Attack Path

How an attacker could exploit the issue

An attacker who can create or modify workflows within the n8n automation platform can exploit a sandbox bypass vulnerability in the Python Code Node. This allows them to execute arbitrary commands on the server running n8n, with the same access level as the n8n process itself.

Authenticated user with workflow access required.
Triggered by crafting malicious Python code in the node.
Allows arbitrary command execution on host.

Live Threat

Current exploitation, exposure, and threat context

An authenticated user with workflow creation privileges could bypass the Python Code Node's sandbox, potentially leading to arbitrary command execution on the host system where n8n is running. This could affect the integrity and confidentiality of the n8n system and any data it processes.

Host system commands could be run.
Sandbox bypass via Python Code Node.
Compromised system integrity and data.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world action for this vulnerability likely falls to the platform or application owners responsible for the n8n instance. The first practical step is to identify all n8n deployments, determine if they are internet-facing or host business-critical workflows, and confirm the accountable owner. Remediation planning should then be risk-based, considering the potential for arbitrary code execution.

Platform/application owners should take ownership.
Verify n8n instance reachability and criticality.
Plan risk-based remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is n8n and how is it used?

n8n is an open-source workflow automation platform designed to connect different web services, applications, and APIs. It allows users to build complex automated processes visually, often serving as a central hub or middleware that integrates disparate systems. Because it needs to interact with various internet-based endpoints, it is frequently deployed as a web-accessible service or API gateway within an organization's infrastructure.

What does this sandbox bypass mean for CVE-2025-68668?

This vulnerability is classified as CWE-693: Protection Mechanism Failure. In the context of n8n, it means the security boundaries meant to isolate code execution in the Python Code Node are ineffective. Instead of restricting the code to a safe, contained environment, the bug allows an attacker to break out of that sandbox and execute arbitrary commands directly on the host operating system with the same permissions as the n8n process.

How can an attacker trigger this vulnerability?

The trigger requires an authenticated user with sufficient permissions to create or modify workflows within the n8n platform. By crafting and executing specific, malicious Python code within the affected node, the user can force the application to run system-level commands. This vulnerability is not triggered by external, unauthenticated requests, nor does it affect workflows that do not utilize the Python Code Node or are restricted from user input.

Is my n8n instance at risk?

According to Halo Surface Signal, risk is elevated because n8n is often deployed as an internet-facing service to facilitate integrations. Even if your instance is internal, any user with workflow modification access could exploit this flaw. You should prioritize assessing instances that are reachable over the network, as these provide a wider attack surface for authenticated users to interact with the platform remotely.

What are the first steps to secure n8n?

If you are running a version between 1.0.0 and 2.0.0, the primary recommendation is to update to version 2.0.0 or later. If an immediate update is not possible, you can mitigate the risk by disabling the Code Node entirely, disabling Python support via environment variables, or configuring n8n to utilize the more secure task runner-based Python sandbox instead of the default environment.

References

github.com/n8n-io/n8n/security/advisories/GHSA-62r4-hw23-cc8v

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.