Exploitation Summary
EIP tracks 3 public exploits for CVE-2026-25049. PoCs published by XiaomingX, 0xBlackash, otakuliu.
AI-analyzed exploit summary This repository demonstrates a JavaScript sandbox escape vulnerability (CVE-2026-25049) via destructuring and Reflect API bypasses. It includes functional PoC code and multiple sandbox versions to illustrate patch evasion techniques.
Description
n8n is an open source workflow automation platform. Prior to versions 1.123.17 and 2.5.2, an authenticated user with permission to create or modify workflows could abuse crafted expressions in workflow parameters to trigger unintended system command execution on the host running n8n. This issue has been patched in versions 1.123.17 and 2.5.2.
Exploits (3)
This repository demonstrates a JavaScript sandbox escape vulnerability (CVE-2026-25049) via destructuring and Reflect API bypasses. It includes functional PoC code and multiple sandbox versions to illustrate patch evasion techniques.
This repository provides a detailed technical analysis of CVE-2026-25049, an unauthenticated information disclosure vulnerability in n8n. It includes affected versions, technical details, and mitigation steps but does not contain functional exploit code.
This repository demonstrates a JavaScript sandbox escape simulation lab, showcasing how different payloads (including CVE-2026-25049) can bypass sandbox restrictions through techniques like destructuring and Reflect API access. It includes multiple sandbox versions to illustrate the evolution of patches and bypasses.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H