n8n
vulnerable targetworkflow automation platform
n8n service version 2.10.0, exposed on host port 5678, with Task Runners enabled in internal mode and secure cookie disabled. A named volume persists n8n data.
docker-compose.yml:3-17DexSemon/CVE-2026-27495
PoC files
3 filesFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
Python script that authenticates to n8n, creates a workflow containing a JavaScript sandbox escape payload, executes it, and extracts results. It includes both a probe mode (--probe) that detects the vulnerability and an RCE mode (--cmd) that executes arbitrary OS commands via child_process.execSync when NODE_FUNCTION_ALLOW_BUILTIN=* is set.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README and a Python exploit script for CVE-2026-27495. The script authenticates to a target n8n instance, creates a workflow containing a JavaScript sandbox escape payload, executes it, and displays the results. All behavior is consistent with a legitimate proof-of-concept exploit for the stated vulnerability. No concealed executable behavior, unrelated remote access, persistence mechanisms, credential exfiltration, or deceptive payloads were observed.
ClassificationExploit
Model confidence98%
AuthenticationRequired
Languages
Target software
Attack types
Evidence & reasoningClassification basis · observed behavior · safety review
Classification basis and observed behavior
Classification basis
The artifact contains a complete Python script that actively exploits CVE-2026-27495 by authenticating to n8n, injecting a sandbox escape payload into a workflow, executing it, and extracting results. The RCE mode executes arbitrary OS commands, which is exploitation, not mere detection.
exploit.py:210-280exploit.py:17-36Requirements
- Authenticated user with permission to create or modify workflows
exploit.py:95-104 - Task Runners enabled (N8N_RUNNERS_ENABLED=true)
README.md:12 - For RCE mode, NODE_FUNCTION_ALLOW_BUILTIN=* must be set
README.md:38
Observed behavior
- Authenticates to n8n instance using provided credentials
exploit.py:95-104 - Creates a workflow containing a Code node with a JavaScript sandbox escape payload
exploit.py:106-136 - Executes the workflow and polls for completion
exploit.py:138-163 - In probe mode, checks if sandbox was escaped and host constructors are mutable
exploit.py:39-72 - In RCE mode, executes an OS command via child_process.execSync and returns output
exploit.py:17-36
Behaviors behind the backdoor verdict
Observables
- Credential Handling
- The script accepts email and password arguments and sends them to the target n8n instance for authentication.Credentials are used only for the intended exploit flow against the user-specified target; no exfiltration to a third party is observed.
exploit.py:95-104exploit.py:289-292 - Command Execution
- The script can execute an arbitrary OS command on the target via the sandbox escape when NODE_FUNCTION_ALLOW_BUILTIN=* is set.This is the documented RCE capability of the CVE-2026-27495 exploit and is controlled by the user-supplied --cmd argument.
exploit.py:17-37exploit.py:293-294 - Network Communication
- The script sends HTTP requests to the target n8n instance at the user-specified --url.All network traffic is directed to the target specified by the user; no hardcoded external callbacks or data leaks are present.
exploit.py:77-83exploit.py:287-288
What the analysis did not establish
- One file (likely docker-compose.yml) is omitted from the evidence; its content is not available for analysis.
- The evidence does not include execution output or verification that the exploit was successfully run.
- One file (docker-compose.yml, 445 bytes) was present in the repository but not included as readable text; its content was not reviewed. The exploit script does not import or execute it, and it is described in the README as a lab deployment file.
Model interpretation
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
Docker lab environments
1GitHubdocker-compose.yml
Created Vuln labCVE-2026-27495Compose · images
Analysis
Environment assessment
A Docker Compose environment deploying a single n8n instance (version 2.10.0) with Task Runners enabled, intended as a vulnerable lab for CVE-2026-27495 sandbox escape testing.
docker-compose.yml:1-21README.md:1-10Lab assessment
Vulnerability labThe README explicitly states the environment is for CVE-2026-27495, a sandbox escape in n8n JS Task Runner, and provides step-by-step instructions for deploying the vulnerable lab and running the exploit.
README.md:1-10README.md:12-18Lab shapeCompose · images
Services1
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Services and files described by the evidence
exploit.py
exploit scriptproof-of-concept
Python script that authenticates to the n8n instance, creates a workflow containing a JavaScript payload that attempts sandbox escape via host-realm object leak, executes the workflow, and extracts results. Supports probe-only mode and RCE mode (requires NODE_FUNCTION_ALLOW_BUILTIN=*).
exploit.py:1-314How the supplied evidence relates each vulnerability
CVE-2026-27495
Supported by supplied evidence
The README and exploit script both explicitly reference CVE-2026-27495, describe the sandbox escape vulnerability in n8n JS Task Runner, and provide a working proof-of-concept that probes and exploits the described behavior.
README.md:1-10exploit.py:1-6exploit.py:15-30Requirements and sequence described by the evidence
Prerequisites
- Docker and Docker Compose installed to deploy the lab.
README.md:12-14 - Python 3 with requests library installed to run the exploit.
README.md:20-22 - n8n instance accessible at http://localhost:5678 with an owner account (created manually or via --setup).
README.md:14-18exploit.py:80-88 - For RCE mode, NODE_FUNCTION_ALLOW_BUILTIN=* must be uncommented in docker-compose.yml and the service restarted.
README.md:28-32docker-compose.yml:11
Evidence-described exercise path
- Deploy the vulnerable n8n lab using 'docker compose up -d'.
README.md:12-14 - Wait ~15s for n8n to start, then open http://localhost:5678 and create an owner account (email: admin@test.com, password: TestPassword123!).
README.md:14-18 - Install Python dependency: pip install requests.
README.md:20-22 - Run sandbox escape probe: python3 exploit.py --probe.
README.md:24-26 - For RCE, uncomment NODE_FUNCTION_ALLOW_BUILTIN=* in docker-compose.yml, restart the service, then run: python3 exploit.py --cmd 'id && cat /etc/passwd'.
README.md:28-32
Behaviors behind the stored safety assessment
No harmful behavior observed
The exploit script targets only the n8n container via the documented REST API, creates and deletes workflows, and executes commands within the container's own Task Runner. No evidence of host escape, external connectivity, persistence, credential theft, or destructive behavior beyond the intended lab target.
exploit.py:80-88exploit.py:90-100exploit.py:102-120exploit.py:122-140exploit.py:142-160exploit.py:162-180exploit.py:182-200exploit.py:202-220exploit.py:222-240exploit.py:242-260exploit.py:262-280exploit.py:282-300exploit.py:302-314What the analysis did not establish
- No Dockerfile or other build context present; the environment relies solely on a pre-built image.
- The exploit script's JavaScript payloads are complex and could contain subtle unintended behavior, but static analysis shows no obvious malicious actions beyond the described sandbox escape.
Model interpretation
This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.