Exploit for Improper Input Validation in N8N

CVE-2025-68613 CVE-2026-21858

githubexploit · 2026-07-21

Description

Improper input validation in n8n enables unauthenticated file read and remote code execution.

Entry point

Parameternodes[1].parameters.values.string[0].value · request body

Pathrest/workflows

Creation of a malicious workflow containing an evaluated expression payload leading to RCE via n8n workflow expression evaluation.

Affected n8n versions

n8n< 1.120.4, 1.121.0

All known vulnerabilities by product

CVSS Score

10.0

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:CHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:NONE

Working code

100%confidence this exploit runs

Based on 6 file(s) in the source

EPSS Score

99.1%higher than 99.9% of all CVEs

Updated 2026-09-05

Exploit Details

Modified:2026-07-21 08:56

Last Seen:2026-07-21 09:04

Reporter:qianlijaingshan

Written in:Python

Last commit:2026-07-21

Tags

n8n vulnerabilityinput validationunauthenticated file readremote code execution

Other exploits for the same CVE

2026-09-10 KitPloitKITPLOIT

2026-09-10 KitPloitKITPLOIT

CVE-2026-21858-and-CVE-2025-68613

2026-09-10 KitPloitKITPLOIT

n8n-exploit-CVE-2025-68613-n8n-God-Mode-Ultimate

2026-09-10 KitPloitKITPLOIT

CVE-2025-68613-POC

2026-09-10 KitPloitKITPLOIT

n8n_CVE-2025-68613_exploit_payloads

2026-09-10 KitPloitKITPLOIT

Research-CVE-2026-21858

2026-09-10 KitPloitKITPLOIT

Ashwesker-CVE-2026-21858

2026-09-10 KitPloitKITPLOIT

Exploit Code

README3 lines

## https://sploitus.com/exploit?id=E264E34D-6C44-5124-8612-23E8D31DEC00
# n8n-cve-2026-21858
CVE-2026-21858 + CVE-2025-68613 — n8n unauthenticated file read to RCE exploit