thinQtankLABS

Root-Cause & Secure-Code Remediation: CVE-2025-68613

Fix CVE-2025-68613 at the source. Read the vulnerable n8n expression evaluator, see how it compiles user expressions with new Function so require()/process reach the server runtime (CWE-913), reject a string denylist, deploy an isolated-vm sandbox with no Node globals, harden the runtime (restricted editing + least privilege), and verify with audit and vulnscan.

Expert 20 guided steps 4 tasks About 80 minutes Runs in your browser

Skills you will practice

  • Root-cause analysis
  • Reading upstream patches
  • CWE-913 safe code evaluation
  • Sandboxing / isolation (isolated-vm)
  • Denylist vs isolation
  • Static code review (SAST)
  • Least privilege
  • Defense in depth

Certifications this lab maps to

This lab builds hands-on skills that appear on these certification exams. thinQtank Learning runs instructor-led training camps for each — click one to see upcoming classes.

ISC2 CSSLP CSSLP Secure software design, safe code evaluation / sandboxing Training at thinQtank Learning CompTIA PenTest+ PT0-003 RCE via code injection, root cause and remediation Training at thinQtank Learning CompTIA SecurityX CAS-005 (CASP+) Secure architecture, isolation and least privilege Training at thinQtank Learning
Part of these certification lab packages: PenTest+ PT0-003 SecurityX (CASP+) CAS-005 CSSLP

The scenario

Triage upgraded the server; IR handled the breach. You are the security engineer who has to fix the code and harden the runtime. Start at the source.

What you will do

  1. Understand the root cause4 steps

    Open the source · Read the root-cause note · Read the vulnerable evaluator · What is the sink?

  2. Audit and reject the weak fix4 steps

    Audit the vulnerable file · Read the proposed fix · Audit the weak fix · Why is the denylist insufficient?

  3. Apply the fix and harden the runtime8 steps

    Read the correct fix · Audit the correct fix · What makes it safe? · Deploy the fix · …

  4. Reason and document4 steps

    Verify the deployed evaluator · Two layers · Write the PR note · The principle

How this lab works

A real Linux-style console. Commands run against real files, so hashes, hex dumps and comparisons give real results.

A file browser where you can place evidence into the lab, either the file provided or one of your own.

Reset a single step, a whole task or the entire lab. The environment is rebuilt so you can try again cleanly.

Progress saves after every step. Close the tab and come back later; your files and answers are waiting.