n8n 0.123.0-1.121.2 - Authenticated Remote Code Execution via Git Node
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2026-21877. PoCs published by monkeontheroof, CVEs-Labs. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2026-21877, demonstrating a reverse shell payload executed via a Node.js script. The exploit uses a FIFO pipe and netcat to establish a reverse shell connection to an attacker-controlled server.
Description
n8n is an open source workflow automation platform. In versions 0.121.2 and below, an authenticated attacker may be able to execute malicious code using the n8n service. This could result in full compromise and can impact both self-hosted and n8n Cloud instances. This issue is fixed in version 1.121.3. Administrators can reduce exposure by disabling the Git node and limiting access for untrusted users, but upgrading to the latest version is recommended.
Exploits (2)
This repository contains a functional exploit for CVE-2026-21877, demonstrating a reverse shell payload executed via a Node.js script. The exploit uses a FIFO pipe and netcat to establish a reverse shell connection to an attacker-controlled server.
This repository contains a functional exploit for CVE-2026-21877, targeting a command injection vulnerability in n8n workflow automation. The exploit sends a malicious payload to a custom webhook endpoint, achieving remote code execution (RCE) on the target system.
Nuclei Templates (1)
http.favicon.hash:-831756631
icon_hash="-831756631"
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H