thinQtankLABS

Automation Platform Patch Triage & Remediation: CVE-2025-68613

Triage a Critical, CISA-KEV-listed n8n workflow-expression RCE (CVE-2025-68613) where a low-trust editor escapes the expression sandbox to run code on the server: confirm the version, score it with CVSS and see why it is 9.9 despite needing a login (scope changed), identify CWE-913, judge the insider threat model, upgrade and verify.

Beginner 21 guided steps 5 tasks About 50 minutes Runs in your browser

Skills you will practice

  • Application vulnerability management
  • Version confirmation
  • CVSS v3.1 scoring (scope changed
  • PR)
  • CWE-913 identification
  • Insider / shared-tenancy threat modeling
  • Patch verification

Certifications this lab maps to

This lab builds hands-on skills that appear on these certification exams. thinQtank Learning runs instructor-led training camps for each — click one to see upcoming classes.

CompTIA Security+ SY0-701 Vulnerability and patch management Training at thinQtank Learning CompTIA CySA+ CS0-003 Vulnerability identification and prioritization Training at thinQtank Learning CompTIA Linux+ XK0-005 Application updates and service hardening Training at thinQtank Learning
Part of these certification lab packages: Security+ SY0-701 CySA+ CS0-003 Linux+ XK0-005 Certified in Cybersecurity (CC) GSEC GSEC

The scenario

You are the systems analyst on call. The scanner flagged CVE-2025-68613 — a workflow-expression remote code execution in self-hosted n8n, where an authenticated editor can escape the expression sandbox and run code on the server — and it is in the CISA KEV catalog. Start by understanding it.

What you will do

  1. Triage the alert4 steps

    Open the ticket · Read the scan report · Which CVE? · Read the ticket

  2. Confirm the version4 steps

    Check the version · What version is running? · Read the advisory · Is the host affected?

  3. Assess the severity5 steps

    Find the CVSS vector · Compute the base score · What is the base score? · Why still Critical with PR:L? · …

  4. Confirm exposure and scan2 steps

    Check exposure · Baseline scan

  5. Remediate and verify6 steps

    Which fixed version? · Upgrade n8n · Confirm the version · Verify with a scan · …

How this lab works

A real Linux-style console. Commands run against real files, so hashes, hex dumps and comparisons give real results.

A file browser where you can place evidence into the lab, either the file provided or one of your own.

Reset a single step, a whole task or the entire lab. The environment is rebuilt so you can try again cleanly.

Progress saves after every step. Close the tab and come back later; your files and answers are waiting.