CVE-2025-68668 (CNNVD-202512-4823)
中文标题:
n8n 安全漏洞
英文标题:
n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Node
漏洞描述
中文描述:
n8n是n8n开源的一个可扩展的工作流自动化工具。 n8n 1.0.0版本至2.0.0之前版本存在安全漏洞，该漏洞源于Python Code Node存在沙箱绕过问题，可能导致执行任意命令。
英文描述:
n8n is an open source workflow automation platform. From version 1.0.0 to before 2.0.0, a sandbox bypass vulnerability exists in the Python Code Node that uses Pyodide. An authenticated user with permission to create or modify workflows can exploit this vulnerability to execute arbitrary commands on the host system running n8n, using the same privileges as the n8n process. This issue has been patched in version 2.0.0. Workarounds for this issue involve disabling the Code Node by setting the environment variable NODES_EXCLUDE: "[\"n8n-nodes-base.code\"]", disabling Python support in the Code node by setting the environment variable N8N_PYTHON_ENABLED=false, which was introduced in n8n version 1.104.0, and configuring n8n to use the task runner based Python sandbox via the N8N_RUNNERS_ENABLED and N8N_NATIVE_PYTHON_RUNNER environment variables.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| n8n-io | n8n | >= 1.0.0, < 2.0.0 | - | - |
cpe:2.3:a:n8n-io:n8n:>=_1.0.0,_<_2.0.0:*:*:*:*:*:*:*
|
| n8n | n8n | * | - | - |
cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
3.1 (cna)
CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2025-68668 |
2026-01-07 02:47:02 | 2026-01-12 02:12:31 |
| NVD | nvd_CVE-2025-68668 |
2026-01-06 03:00:09 | 2026-01-12 02:28:14 |
| CNNVD | cnnvd_CNNVD-202512-4823 |
2026-01-11 06:15:05 | 2026-01-12 02:38:07 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 其他
- cnnvd_id: 未提取 -> CNNVD-202512-4823
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- affected_products_count: 1 -> 2
- references_count: 1 -> 2
- data_sources: ['cve'] -> ['cve', 'nvd']