219 matches found
CVE-2025-65964-Exploit
Reproduction Steps First, prepare a repository containing a malicious file. root@kitploit: mkdir n8n-rce-poc && cd n8n-rce-poc git init git remote add origin mkdir evilhooks echo '!/bin/sh' evilhooks/pre-commit echo 'touch /tmp/pwnedsuccess' evilhooks/pre-commit chmod +x evilhooks/pre-commit git...
EUVD-2026-70407
n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and Function nodes. The validation logic checks the uri property for SSRF safety while the underlying HTTP client uses the url property when both are present,...
CVE-2026-85172
n8n versions before 2.34.1 contain a server-side request forgery (SSRF) vulnerability in the legacy request helper function exposed to Code and Function nodes. The root cause is a mismatch between validation and execution: the SSRF check inspects the uri property, while the underlying HTTP client...
EUVD-2026-67809
BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow runonce endpoint that allows authenticated users to execute arbitrary Python code. Attackers can submit crafted Code node definitions to the POST /api/v1/workflow/runonce endpoint, which executes them with exec...
CVE-2026-77083
n8n is a workflow automation platform. In versions prior to 1.123.69, 2.33.4, and 2.34.1, the JavaScript Code node's VM sandbox did not freeze the sandbox's Function.prototype, allowing an authenticated user with the ability to create and execute workflows to pollute it from within a Code node...
CVE-2026-77077
n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis functions but not internal module constructors such as EventEmitter, allowing an authenticated user with Code node access to exploit...
CVE-2026-77083
n8n (workflow automation platform) versions prior to 1.123.69 , 2.33.4 , and 2.34.1 are affected by a sandbox escape in the JavaScript Code node. The VM sandbox did not freeze Function.prototype, allowing an authenticated user with workflow creation and execution privileges to perform prototype p...
EUVD-2026-63271
n8n is a workflow automation platform. In versions prior to 1.123.69, 2.33.4, and 2.34.1, the JavaScript Code node's VM sandbox did not freeze the sandbox's Function.prototype, allowing an authenticated user with the ability to create and execute workflows to pollute it from within a Code node...
CVE-2026-77083 n8n before 1.123.69 Code Node Sandbox Escape via Function.prototype Pollution
n8n is a workflow automation platform. In versions prior to 1.123.69, 2.33.4, and 2.34.1, the JavaScript Code node's VM sandbox did not freeze the sandbox's Function.prototype, allowing an authenticated user with the ability to create and execute workflows to pollute it from within a Code node...
CVE-2026-77083 n8n before 1.123.69 Code Node Sandbox Escape via Function.prototype Pollution
n8n is a workflow automation platform. In versions prior to 1.123.69, 2.33.4, and 2.34.1, the JavaScript Code node's VM sandbox did not freeze the sandbox's Function.prototype, allowing an authenticated user with the ability to create and execute workflows to pollute it from within a Code node...
CVE-2026-77077 n8n before 1.123.69 Remote Code Execution via EventEmitter Prototype Pollution
n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis functions but not internal module constructors such as EventEmitter, allowing an authenticated user with Code node access to exploit...
CVE-2026-77077 n8n before 1.123.69 Remote Code Execution via EventEmitter Prototype Pollution
n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis functions but not internal module constructors such as EventEmitter, allowing an authenticated user with Code node access to exploit...
EUVD-2026-63266
n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis functions but not internal module constructors such as EventEmitter, allowing an authenticated user with Code node access to exploit...
CVE-2026-77077
n8n versions before 1.123.69, 2.33.4, and 2.34.1 have a VM sandbox escape in the task runner: the prototype-freezing routine misses internal constructors like EventEmitter, allowing an authenticated user with Code node access to pollute prototypes and execute arbitrary commands. The corruption is...
CVE-2026-77077 n8n before 1.123.69 Remote Code Execution via EventEmitter Prototype Pollution
n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis functions but not internal module constructors such as EventEmitter, allowing an authenticated user with Code node access to exploit...
CVE-2026-72764
n8n's JavaScript task runner shared a single module cache across all users' Code-node executions. In affected versions before 1.123.67, 2.31.5, and 2.32.1, a user able to run a Code node could poison a cached module and thereby alter other users' Code-node executions on the same runner, affecting...
CVE-2026-72764
n8n's JavaScript task runner shared a single module cache across all users' Code-node executions. In affected versions before 1.123.67, 2.31.5, and 2.32.1, a user able to run a Code node could poison a cached module and thereby alter other users' Code-node executions on the same runner, affecting...
CVE-2026-72764 n8n before 1.123.67 Module Cache Poisoning via Code Node
n8n's JavaScript task runner shared a single module cache across all users' Code-node executions. In affected versions before 1.123.67, 2.31.5, and 2.32.1, a user able to run a Code node could poison a cached module and thereby alter other users' Code-node executions on the same runner, affecting...
CVE-2026-72764
n8n CVE-2026-72764 affects multi-user n8n instances using the JS task runner with built-in or external modules. Before versions 1.123.67, 2.31.5, and 2.32.1, a user who can run a Code node could poison the shared module cache, altering other users’ Code-node executions on the same runner. This is...
CVE-2026-72764 n8n before 1.123.67 Module Cache Poisoning via Code Node
n8n's JavaScript task runner shared a single module cache across all users' Code-node executions. In affected versions before 1.123.67, 2.31.5, and 2.32.1, a user able to run a Code node could poison a cached module and thereby alter other users' Code-node executions on the same runner, affecting...