Description
This module exploits a critical remote code execution vulnerability (CVE-2025-68613) in the n8n workflow automation platform. The vulnerability exists in the workflow expression evaluation system where user-supplied expressions enclosed in {{ }} are evaluated in an execution context that is not sufficiently isolated from the underlying Node.js runtime.
An authenticated attacker can create a workflow containing malicious expressions that access the Node.js process object via this.process.mainModule.require (or via the constructor) to load child_process and execute arbitrary system commands. This module uses a Schedule Trigger node to automatically fire and evaluate the malicious payload. This requires valid credentials to create workflows.
Successful exploitation may lead to full compromise of the n8n instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations.
Affected versions: >= 0.211.0 and < 1.120.4, < 1.121.1, < 1.122.0
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/multi/http/n8n/workflow_expression_rcemsf undefined(workflow_expression_rce) > show actions ...actions...msf undefined(workflow_expression_rce) > set ACTION < action-name >msf undefined(workflow_expression_rce) > show options ...show and set options...msf undefined(workflow_expression_rce) > runPrioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub