自托管的 n8n 存在 Legacy Code 节点，允许任意文件读取/写入

An attacker exploiting this vulnerability could gain unauthorized access to sensitive files stored on the n8n host. This includes configuration files, database backups, and potentially other application data. The ability to write files allows for further malicious actions, such as overwriting critical system files or injecting malicious code. The scope of the attack is limited by file-access restrictions configured within the n8n instance and the underlying operating system/container permissions. Successful exploitation requires an authenticated user with workflow editing privileges, making it a privilege escalation concern within the n8n environment.

Organizations utilizing self-hosted n8n instances, particularly those relying on legacy JavaScript execution mode within the Code node, are at risk. Environments with relaxed file-access restrictions or shared hosting configurations are especially vulnerable, as they may provide broader access to the underlying file system.

• nodejs / server: Monitor n8n logs for unusual file access patterns or attempts to invoke internal helper functions from within the Code node. Use lsof or fuser to identify processes accessing sensitive files.

lsof /path/to/sensitive/file

• nodejs / server: Review n8n workflow configurations for suspicious Code node scripts that might attempt to access or modify files outside of the intended scope.

grep -r 'require('fs')' /path/to/n8n/workflows

• generic web: Examine n8n server access logs for requests originating from authenticated users with workflow editing privileges that exhibit unusual file access patterns.

1. 2025-12-26Disclosure

   disclosure

1. 已保留2025-12-23
2. 发布日期2025-12-26
3. 修改日期2025-12-31
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2025-68697 is to upgrade to n8n version 2.0.0 or later, which addresses the vulnerable code execution path. If upgrading is not immediately feasible, consider disabling the legacy JavaScript execution mode within the Code node configuration. Additionally, ensure that file-access restrictions are properly configured within the n8n instance to limit the potential impact of a successful exploit. Review and tighten OS-level permissions on the n8n host to further restrict file access. There are no specific WAF rules or detection signatures readily available for this vulnerability, making proactive monitoring and timely patching crucial.