CVE-2025-68697
High · 7.1Self-hosted n8n has Legacy Code node that enables arbitrary file read/write
CVSS
7.1
EPSS
0.3%
Published
Dec 26, 2025
CISA due date
—
The record
In self-hosted n8n instances where the Code node runs in legacy (non-task-runner) JavaScript execution mode, authenticated users with workflow editing access can invoke internal helper functions from within the Code node. This allows a workflow editor to perform actions on the n8n host with the same privileges as the n8n process, including: - Reading files from the host filesystem (subject to any file-access restrictions configured on the instance and OS/container permissions) - Writing files to the host filesystem (subject to the same restrictions) Starting with n8n version 1.2.1, access to files in the n8n home directory (`.n8n`) is blocked by default. However, this does not restrict access to other parts of the filesystem unless additional file access limitations are configured.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | n8n | 1.2.1 | 2.0.0 |
Related vulnerabilities
- GHSA-j4p8-h8mh-rh8q Self-hosted n8n has Legacy Code node that enables arbitrary file read/write Same vulnerability
- CVE-2026-54308 n8n is an open source workflow automation platform. Also affects n8n
- CVE-2026-54307 n8n is an open source workflow automation platform. Also affects n8n
- CVE-2026-54304 n8n is an open source workflow automation platform. Also affects n8n
- CVE-2026-54305 n8n is an open source workflow automation platform. Also affects n8n
- CVE-2026-54306 n8n is an open source workflow automation platform. Also affects n8n
- CVE-2026-54302 n8n is an open source workflow automation platform. Also affects n8n
- CVE-2026-54301 n8n is an open source workflow automation platform. Also affects n8n