CVE-2025-68668: DEF CON 34: One Pyodide Escape Broke the Sandbox in Seven Products at Once
CVE-2025-68668 is a critical-severity remote code execution issue in n, an AI agent. Affected: n8n (CVE-2025-68668), Grist (CVE-2026-24002), Cohere Terrarium (CVE-2026-61522), Hugging Face smolagents (CVE-2026-10613), langchain-sandbox, stlite, cibuildwheel.
Is n running on your developers' machines? Anomity finds every device with this AI agent installed, shows the version, and can block it by policy. Detect this across your developers' devices with Anomity →
Key facts
- ID
CVE-2025-68668- Severity
- critical
- Attack type
- Remote code execution, Sandbox escape
- Component
- n · AI agent
- Known exploited
- No known exploitation
- Published
- Last verified
What is CVE-2025-68668?
Cyera researchers Vladimir Tokarev and Saar Pearl showed that products relying on Pyodide for sandboxed Python were enforcing their restrictions only at the Python level, while the ctypes module and Emscripten-exported functions offered a path straight into the JavaScript host runtime. The same escape reproduced across workflow automation, spreadsheets, AI agent runtimes, desktop apps and CI tooling: n8n (CVE-2025-68668, 9.9), Cohere Terrarium (CVE-2026-61522, 9.3), Grist (CVE-2026-24002, 9.1), Hugging Face smolagents (CVE-2026-10613, 8.3), plus langchain-sandbox, stlite and cibuildwheel. Maintainer responses diverged sharply: some re-architected, some archived the component, and some held that isolation is the deployer's responsibility.
Affected versions
| Affected | Fixed in |
|---|---|
n8n (CVE-2025-68668), Grist (CVE-2026-24002), Cohere Terrarium (CVE-2026-61522), Hugging Face smolagents (CVE-2026-10613), langchain-sandbox, stlite, cibuildwheel | No fixed version listed |
Am I affected by CVE-2025-68668?
You are affected if you run n8n (CVE-2025-68668), Grist (CVE-2026-24002), Cohere Terrarium (CVE-2026-61522), Hugging Face smolagents (CVE-2026-10613), langchain-sandbox, stlite, cibuildwheel.
How do I fix CVE-2025-68668?
Patch each affected product to its fixed release, and where the maintainer declined to fix, stop counting Pyodide as an isolation boundary at all. Any agent runtime that executes model-generated Python inside Pyodide needs a real boundary underneath it: an ephemeral container, no ambient cloud credentials in the process, and restricted outbound network.
How do I find every machine running n?
Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run n and which version, then enforce a policy on it.