Ak-cybe/CVE-2025-68613-n8n-rce-analysis

GitHubRepository PoCWriteup

PoC files

7 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A detailed technical writeup and analysis of CVE-2025-68613, an RCE vulnerability in n8n. The document describes the vulnerability, attack flow, and provides example payloads and screenshots, but does not contain executable exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence is a single README.md file that documents CVE-2025-68613, an n8n RCE vulnerability. It contains educational analysis, screenshots, and example payloads for the stated vulnerability. No backdoor, deceptive payload, or concealed operator-directed harm targeting the reviewer was observed.

ClassificationWriteup
Model confidence95%
AuthenticationRequired
LanguagesMarkdown
Target softwaren8n
Attack typesRemote Code ExecutionExpression InjectionSandbox Escape
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a README.md file containing a detailed technical analysis, screenshots, and example payloads for CVE-2025-68613. It does not contain any executable exploit or scanner code; the provided bash script is a version audit, not a vulnerability scanner. The primary purpose is educational and analytical, making it a writeup.

README.md:1-579

Requirements

  • Valid n8n user account (low-privilege sufficient) with workflow creation/editing capability and network access to the instance.README.md:139-141

Observed behavior

  • Describes injecting a malicious expression into a workflow's Set node to escape the sandbox and execute OS commands via child_process.README.md:225-237
  • Provides example payloads for executing commands like 'id', 'pwd', and 'cat /etc/passwd'.README.md:251-269
  • Includes a bash script for auditing n8n version to check for vulnerability.README.md:448-467
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Payload Example
{{ (function(){ return this.process.mainModule.require('child_process').execSync('id').toString(); })() }}Example expression injection payload demonstrating the documented CVE-2025-68613 vulnerability against n8n.README.md:236
Payload Example
{{ (function(){ return this.process.mainModule.require('child_process').execSync('cat /etc/passwd').toString() })() }}Example payload for reading /etc/passwd, consistent with the documented vulnerability.README.md:263
External Reference
https://github.com/TheStingR/CVE-2025-68613-POCLink to an external public PoC scanner; not part of the reviewed artifact code.README.md:550
Review boundaries

What the analysis did not establish

  • Only the README.md file was provided; 6 non-text media files (screenshots) were omitted. The analysis is based solely on the text content of the writeup.
  • The artifact's own analysis_routing classification is 'NO_POC_CODE_IDENTIFIED', which aligns with the writeup classification.
  • Six non-text media files (assets/*.png) were flagged as binary and not analyzed; they are referenced as screenshots in the README and could theoretically contain steganographic or malicious content, but no evidence of this is present in the reviewed text.
  • The artifact is a documentation repository; no executable source code was identified for review.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1