CVE-2025-68668: Critical Python Sandbox Bypass in n8n

CVE-2025-68668 is a critical (CVSS 9.9) sandbox bypass in the Python Code node of n8n, versions 1.0.0 up to before 2.0.0. A user who can create or edit workflows could run commands on the host. The fix is n8n 2.0.0 or later, and the advisory lists workarounds if you cannot upgrade yet.

What's affected

n8n from 1.0.0 to before 2.0.0. The patched version is 2.0.0, per the record and GitHub advisory GHSA-62r4-hw23-cc8v. The record and advisory agree on the score of 9.9 and the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L.

The vector lists privileges required as low. In practice the attacker must be an authenticated user allowed to create or modify workflows, which in many teams is a wide group. The command runs with the same privileges as the n8n process. The record lists CWE-693 (protection mechanism failure). The record does not mark this as exploited in the wild (KEV is false), and the advisory does not say so.

The advisory notes that a task runner based native Python implementation arrived in 1.111.0 as an optional feature and became the default in 2.0.0.

How to check if you're exposed

Check your n8n version. For npm or a local install:

n8n --version

For a container, run the same command inside it:

docker exec <container-name> n8n --version

Any 1.x release is in scope. Then check which workaround settings you already use:

env | grep -E "NODES_EXCLUDE|N8N_PYTHON_ENABLED|N8N_RUNNERS_ENABLED|N8N_NATIVE_PYTHON_RUNNER"

Also list who can create or edit workflows. That group is the real exposure for this CVE.

What to do now

1. Upgrade to n8n 2.0.0 or later. This is a major version, so read the release notes for breaking changes and test your workflows first.
2. If you cannot upgrade yet, apply the advisory workarounds. Set NODES_EXCLUDE to exclude n8n-nodes-base.code to disable the Code node, or set N8N_PYTHON_ENABLED=false (available since 1.104.0) to disable Python in it.
3. Alternatively, use the task runner Python sandbox by configuring N8N_RUNNERS_ENABLED and N8N_NATIVE_PYTHON_RUNNER, per the advisory.
4. Trim the list of people who can edit workflows to those who need it.
5. Run n8n as an unprivileged user and keep credentials for other systems scoped narrowly, since a host command runs with the process rights.

Why it matters

Workflow tools hold keys to many other systems. An n8n host usually stores credentials for databases, SaaS tools and cloud accounts so that workflows can use them. A flaw that turns workflow editing rights into host command execution lets a low trust user reach all of that, which is why the scope is changed in the CVSS vector.

The cause is a protection mechanism failure. The Python Code node ran user code inside Pyodide, a Python runtime compiled for sandboxed use, and the sandbox could be bypassed. The advisory does not go further, and this post does not either. The long term fix replaces that approach with a task runner based implementation.

The lesson for platform teams is that an in-process sandbox should not be your only boundary for code written by users. Limit who can write code nodes, and isolate the host.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Safeguard Gold entry for CVE-2025-68668
• n8n GitHub security advisory GHSA-62r4-hw23-cc8v
• Researcher write up referenced by the record

Last reviewed: 18 October 2026.