Ak-cybe
Source-scoped identity with 2 associated PoCs and 2 linked vulnerabilities.
Exploit catalog results
Showing 2 PoCs on this page
GitHubAk-cybe/CVE-2025-68664-LangGrinch-PoC
Repository PoCStars: 3Created 2025-12-27ScannerCVE-2025-686645 files
Analysis
Technical assessment
The artifact is a payload generator and documentation for CVE-2025-68664. The Python script (payload withheld) generates JSON payloads for testing the vulnerability but does not contain code to send them to a target or exploit a live system. The README provides a technical writeup and instructions for using the generator. The primary operation is generating and listing test payloads, which is characteristic of a scanner/validator, not an exploit.
Backdoor review
No backdoor observed in reviewed code
The repository contains a documented proof-of-concept (PoC) for CVE-2025-68664, a LangChain serialization injection vulnerability. The supplied text files (README.md, payload withheld, requirements.txt) describe the vulnerability, provide payload examples, and implement a payload generator. No concealed executable behavior, operator-directed harm, persistence, credential theft, or unrelated payloads were observed. The code generates and displays JSON payloads for authorized testing; it does not execute them against any target. The artifact is consistent with a legitimate security research PoC.
Classification basis and observed behavior
Classification basis
The artifact's primary executable component (payload withheld) is a payload generator that creates JSON strings for testing. It does not contain any code to send these payloads to a target, trigger deserialization, or otherwise exploit a vulnerability. The README describes the vulnerability and provides a version detection script. This is consistent with a scanner (code that checks for a vulnerability without exploiting it).
langgrinch_fuzzer.py:1-406README.md:420-464Requirements
- A target application using a vulnerable version of langchain-core (< 0.3.81 or >= 1.0.0 < 1.2.5) that deserializes user-controlled data containing the 'lc' key.
README.md:164-170
Observed behavior
- Generates JSON payloads containing the 'lc' marker for secret extraction, SSRF, RCE, and file read attacks.
langgrinch_fuzzer.py:54-240 - Lists available payloads by category and exports them to a JSON file.
langgrinch_fuzzer.py:346-381 - Provides a version detection script to check if the installed langchain-core is vulnerable.
README.md:420-464
Behaviors behind the backdoor verdict
Observables
- Vulnerability Poc
- Payload withheldThe entire repository is a PoC writeup and payload generator for the stated CVE.
README.md:1-626langgrinch_fuzzer.py:1-406 - Payload Generator
- Payload withheldA Python script that generates and displays JSON payloads for the vulnerability. It does not execute the payloads or connect to any remote service.
langgrinch_fuzzer.py:1-406 - Author Attribution
- Payload withheldThe author is identified in the README and source code. This is metadata and not a backdoor indicator.
README.md:607langgrinch_fuzzer.py:9
What the analysis did not establish
- Two files (PAYLOADS.md and LICENSE) are omitted from the evidence, so the full payload arsenal and license terms are not available for review.
- The evidence does not include any execution logs or network traffic to confirm the payloads work as described.
- Two files (PAYLOADS.md, LICENSE) were present in the repository but not included in the text evidence; only their metadata was provided. No binary or non-text content was identified in the artifact.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubAk-cybe/CVE-2025-68613-n8n-rce-analysis
Repository PoCStars: 1Created 2025-12-26WriteupCVE-2025-686137 files
Analysis
Technical assessment
A detailed technical writeup and analysis of CVE-2025-68613, an RCE vulnerability in n8n. The document describes the vulnerability, attack flow, and provides example payloads and screenshots, but does not contain executable exploit or scanner code.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence is a single README.md file that documents CVE-2025-68613, an n8n RCE vulnerability. It contains educational analysis, screenshots, and example payloads for the stated vulnerability. No backdoor, deceptive payload, or concealed operator-directed harm targeting the reviewer was observed.
Classification basis and observed behavior
Classification basis
The artifact is a README.md file containing a detailed technical analysis, screenshots, and example payloads for CVE-2025-68613. It does not contain any executable exploit or scanner code; the provided bash script is a version audit, not a vulnerability scanner. The primary purpose is educational and analytical, making it a writeup.
README.md:1-579Requirements
- Valid n8n user account (low-privilege sufficient) with workflow creation/editing capability and network access to the instance.
README.md:139-141
Observed behavior
- Describes injecting a malicious expression into a workflow's Set node to escape the sandbox and execute OS commands via child_process.
README.md:225-237 - Provides example payloads for executing commands like 'id', 'pwd', and 'cat /etc/passwd'.
README.md:251-269 - Includes a bash script for auditing n8n version to check for vulnerability.
README.md:448-467
Behaviors behind the backdoor verdict
Observables
- Payload Example
- Payload withheldExample expression injection payload demonstrating the documented CVE-2025-68613 vulnerability against n8n.
README.md:236 - Payload Example
- Payload withheldExample payload for reading /etc/passwd, consistent with the documented vulnerability.
README.md:263 - External Reference
- Payload withheldLink to an external public PoC scanner; not part of the reviewed artifact code.
README.md:550
What the analysis did not establish
- Only the README.md file was provided; 6 non-text media files (screenshots) were omitted. The analysis is based solely on the text content of the writeup.
- The artifact's own analysis_routing classification is 'NO_POC_CODE_IDENTIFIED', which aligns with the writeup classification.
- Six non-text media files (assets/*.png) were flagged as binary and not analyzed; they are referenced as screenshots in the README and could theoretically contain steganographic or malicious content, but no evidence of this is present in the reviewed text.
- The artifact is a documentation repository; no executable source code was identified for review.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.