n8n Node.js Package 0.211.0 < 1.120.4 / 1.121.0 Remote Code Execution via Expression Injection (CVE-2025-68613)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(279637);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/11");

  script_cve_id("CVE-2025-68613");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2026/03/25");

  script_name(english:"n8n Node.js Package 0.211.0 < 1.120.4 / 1.121.0 Remote Code Execution via Expression Injection (CVE-2025-68613)");

  script_set_attribute(attribute:"synopsis", value:
"The n8n Node.js Package installed on the remote host is affected by a remote code execution vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of the n8n Node.js Package installed on the remote host is 0.211.0 prior to 1.120.4, or 1.121.0. It is,
therefore, affected by a remote code execution vis expression injection vulnerability:

  - n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4, 1.121.1,
    and 1.122.0 contain a critical Remote Code Execution (RCE) vulnerability in their workflow expression evaluation
    system. Under certain conditions, expressions supplied by authenticated users during workflow configuration may be
    evaluated in an execution context that is not sufficiently isolated from the underlying runtime. An authenticated
    attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful
    exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data,
    modification of workflows, and execution of system-level operations. (CVE-2025-68613)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://github.com/n8n-io/n8n/security/advisories/GHSA-v98v-ff95-f3cp
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?766bb90f");
  script_set_attribute(attribute:"solution", value:
"Upgrade to n8n Node.js Package version 1.120.4, 1.121.1, 1.122.0 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-68613");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'n8n Workflow Expression Remote Code Execution');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/12/19");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/11/19");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/12/23");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:nodejs:node.js");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nodejs_modules_win_installed.nbin", "nodejs_modules_linux_installed.nbin", "nodejs_modules_mac_installed.nbin");
  script_require_keys("Host/nodejs/modules/enumerated");

  exit(0);
}

include('vcf_extras_nodejs.inc');

get_kb_item_or_exit('Host/nodejs/modules/enumerated');

var app = 'n8n';
var app_info = vcf_extras::nodejs_modules::get_app_info(app:app);

if (empty_or_null(app_info))
  audit(AUDIT_NOT_INST, app);

var constraints = [
  {'min_version':'0.211.0', 'fixed_version':'1.120.4'},
  {'min_version':'1.121.0', 'fixed_version':'1.121.1'}
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);