CVE-2025-68613: n8n Improper Control of Dynamically-Managed Code Resources Vulnerability

Loading…

Source: CISA Known Exploited Vulnerabilities catalog · back to feed

Vendor / product

n8n · n8n

Date added (KEV): Mar 11, 2026
CISA due date: Mar 25, 2026
Ransomware campaign use: Unknown

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Scorifya interpretation

AI-generated

A short, structured read of the record above, generated when this page first loads, then cached for a week.

Plain English

Technical detail

From CISA

n8n contains an improper control of dynamically managed code resources vulnerability in its workflow expression evaluation system that allows for remote code execution.

https://github.com/n8n-io/n8n/security/advisories/GHSA-v98v-ff95-f3cp ; https://nvd.nist.gov/vuln/detail/CVE-2025-68613

See what attackers can see on your domain

This vulnerability is on CISA's Known Exploited Vulnerabilities list, so it is being exploited in the wild right now. Scorifya can't test for n8n directly, but in about 30 seconds it shows what your own domain exposes publicly across TLS, security headers, DNS, and cookies: the surface attackers probe first.

Run a free scan Methodology

SOC 2 compliance

Tracking remediation across your cloud infrastructure?

Scorifya Controls automates 54 SOC 2 checks across AWS, GitHub, GCP, and Azure, and gives you a manual evidence trail for the controls no tool can automate. Self-hosted, three tiers from $99/mo.

See Scorifya Controls →

CVE-2025-68613: n8n Improper Control of Dynamically-Managed Code Resources Vulnerability

Vendor / product

Required action

Scorifya interpretation

From CISA

See what attackers can see on your domain

Tracking remediation across your cloud infrastructure?

References