Zero-Click Nightmare: How a Simple {{77}} in n8n Grants Unauthenticated RCE (CVE-2026-27493) + Video

By /

Listen to this Post

Featured Image

Introduction

Server-Side Template Injection (SSTI) remains one of the most overlooked yet devastating vulnerabilities in modern web applications. When combined with n8n – a popular workflow automation tool – an unauthenticated attacker can achieve remote code execution (RCE) with zero clicks, as demonstrated by CVE-2026-27493. This article dissects the chain exploitation method, provides actionable detection and mitigation steps, and equips you with commands to harden your n8n instances against this critical flaw.

Learning Objectives

  • Understand the full exploitation chain from user input to SSTI to unauthenticated RCE in n8n.
  • Learn to identify vulnerable Form nodes and test for SSTI using safe payloads.
  • Implement immediate mitigations, including version upgrades, input sanitization, and runtime defenses.

You Should Know

  1. Anatomy of the Exploit: From User Input to System Compromise

The vulnerability chain in n8n (CVE-2026-27493) allows any unauthenticated user to inject malicious template expressions through exposed Form nodes. n8n’s workflow engine evaluates certain user-supplied data as JavaScript code when rendered on the browser, leading to SSTI. The critical mistake: raw user input is passed to the template engine without proper sandboxing.

Step-by-step guide to understanding the exploit:

  1. Identify an exposed Form node – These are often used in public-facing workflows (e.g., contact forms, data collection). An attacker simply navigates to the endpoint (e.g., http://target:5678/form/<workflow-id>).

  2. Inject an SSTI test payload – In any input field, submit {{77}}. If the response reflects `49` instead of the literal string, SSTI is confirmed.

  3. Escalate to RCE – The attacker replaces the test payload with:

    {{$node["NodeName"].constructor.constructor('return process.mainModule.require("child_process").execSync("id").toString()')()}}

    This chains JavaScript constructors to access child_process.execSync(), executing arbitrary system commands.

  4. Zero-click aspect – No interaction beyond visiting the form is required; the payload executes on the server during workflow processing.

Linux/macOS test command (safe, non-exploitative) – Use this to check if your instance reflects evaluated expressions:

curl -X POST http://localhost:5678/form/YOUR_FORM_ID \
-H "Content-Type: application/json" \
-d '{"field1":"{{77}}"}'

If response contains `49`, patch immediately.

Windows PowerShell alternative:

Invoke-RestMethod -Uri "http://localhost:5678/form/YOUR_FORM_ID" -Method Post -Body '{"field1":"{{77}}"}' -ContentType "application/json"

2. Immediate Mitigation: Upgrading n8n to Patched Versions

The vendor released fixed versions that disable dangerous template evaluation in Form nodes. You must upgrade to ≥ 2.10.1, 2.9.3, or 1.123.22 depending on your release channel.

Step-by-step upgrade guide:

1. Check current version:

n8n --version

Or if running in Docker:

docker exec -it n8n_container n8n --version

2. Stop the running n8n service:

sudo systemctl stop n8n  systemd
 OR
docker stop n8n_container

3. Upgrade via npm (global installation):

npm update -g n8n

4. For Docker users (recommended):

docker pull n8nio/n8n:latest
docker run -d --name n8n_new -p 5678:5678 n8nio/n8n:latest

5. Verify the upgrade:

n8n --version
 Should output 2.10.1 or higher
  1. Restart and test: Access the web interface and confirm that `{{77}}` in any Form field returns the literal string, not 49.

If you use Kubernetes:

kubectl set image deployment/n8n n8n=n8nio/n8n:2.10.1
kubectl rollout status deployment/n8n

3. Auditing Form Nodes for Vulnerable Configurations

Not every Form node is exploitable. The vulnerability exists only when the node renders user input directly in a template without escaping. Audit all workflows – especially those with public access.

Step-by-step audit procedure:

  1. List all workflows containing Form nodes (requires n8n API access): 
    curl -H "Authorization: Bearer YOUR_API_KEY" \
http://localhost:5678/api/v1/workflows | jq '.data[].nodes[] | select(.type=="n8n-nodes-base.form")'

2. Export each workflow for manual inspection:

curl -H "Authorization: Bearer YOUR_API_KEY" \
http://localhost:5678/api/v1/workflows/{WORKFLOW_ID} > workflow.json
  1. Search for unsafe patterns – In the exported JSON, look for fields where user input is directly concatenated into HTML or template strings. Example vulnerable snippet: 
    "parameters": {
"template": "</li>
</ol>

<div>User input: {{$node['HTTP Request'].json.body}}</div>

"
}
    1. Remediate – Replace dynamic template generation with static fields or use n8n’s built-in `$json` escaping functions. For custom nodes, enforce output sanitization.

    Automated scanner (Linux):

    grep -r "{{.\$node.}}" /path/to/n8n/workflows/ && echo "Potential SSTI risk found"

    4. Hardening n8n Deployments Against Zero-Click Attacks

    Beyond upgrading, implement defense-in-depth to prevent similar vulnerabilities.

    Step-by-step hardening:

    1. Disable public Form access – Place all Form nodes behind authentication using n8n’s basic auth or an API gateway: 
      In n8n configuration file (~/.n8n/.n8n.json)
{
"userManagement": {
"enabled": true,
"authenticationMethod": "basic"
}
}

    2. Restrict execution permissions – Run n8n under a dedicated low-privileged user:

      sudo useradd -r -s /bin/false n8nuser
sudo chown -R n8nuser:n8nuser /home/n8n/.n8n
sudo -u n8nuser n8n start

    3. Use a reverse proxy with WAF rules (NGINX example to block SSTI patterns):

      location /form/ {
if ($request_body ~ "{{[^}]+}}") {
return 403;
}
proxy_pass http://localhost:5678;
}

    4. Enable audit logging – Track all Form submissions:

      export N8N_LOG_LEVEL=debug
export N8N_LOG_OUTPUT=file
export N8N_LOG_FILE=/var/log/n8n/audit.log

    5. Apply a strict Content Security Policy (CSP) – Prevent inline script evaluation even if SSTI occurs:

      Content-Security-Policy: script-src 'self'; object-src 'none'

    5. Detecting Active Exploitation in Your Environment

    If you suspect a breach, look for indicators of compromise (IoCs) specific to n8n RCE.

    Step-by-step detection:

    1. Check n8n logs for unusual eval() calls:

    grep -i "eval|child_process|execSync" /var/log/n8n/.log

    2. Search for unexpected processes spawned by n8n:

    ps aux | grep n8n | grep -E "bash|sh|nc|curl|wget|python|perl"

    3. Examine workflow execution history via API:

    curl -H "Authorization: Bearer YOUR_API_KEY" \
"http://localhost:5678/api/v1/executions?limit=100" | jq '.data[] | select(.status=="success") | .startedAt, .workflowId'
    1. Linux command to detect reverse shells from n8n user: 
      sudo lsof -i -P -n | grep n8nuser | grep ESTABLISHED

    5. Windows equivalent (using PowerShell):

    Get-NetTCPConnection | Where-Object { $<em>.OwningProcess -eq (Get-Process n8n).Id -and $</em>.RemotePort -ne 5678 }

    6. Building a Custom Mitigation: Input Sanitization Middleware

    For environments where immediate upgrade isn’t possible, deploy a proxy middleware that strips SSTI patterns.

    Step-by-step implementation using Node.js:

    1. Create a simple sanitization proxy (`sanitize-proxy.js`):

    const http = require('http');
const { createProxyMiddleware } = require('http-proxy-middleware');

const sanitizeBody = (body) => {
const sstiPattern = /{{[^}]+}}/g;
return body.replace(sstiPattern, '[bash]');
};

const proxy = createProxyMiddleware({
target: 'http://localhost:5678',
onProxyReq: (proxyReq, req, res) => {
if (req.body && typeof req.body === 'string') {
proxyReq.write(sanitizeBody(req.body));
}
}
});

http.createServer((req, res) => {
let body = '';
req.on('data', chunk => body += chunk);
req.on('end', () => {
req.body = sanitizeBody(body);
proxy(req, res);
});
}).listen(8080);

    2. Run the proxy:

    npm install http-proxy-middleware
node sanitize-proxy.js
    1. Redirect traffic from port 5678 to 8080 using iptables: 
      sudo iptables -t nat -A PREROUTING -p tcp --dport 5678 -j REDIRECT --to-port 8080

    2. API Security: Preventing SSTI in Custom n8n Nodes

    If you develop custom n8n nodes, never trust user input. This vulnerability highlights the risk of `$node` object exposure.

    Secure coding guidelines for custom nodes:

    • Use n8n’s `NodeParameterValue` type – It automatically escapes template strings.
    • Avoid eval(), Function(), or `vm.runInNewContext()` with user input.
    • Sanitize all `$json` properties before rendering: 
      const escapeHtml = (str) => str.replace(/[&<>]/g, function(m) {
if (m === '&') return '&';
if (m === '<') return '<';
if (m === '>') return '>';
return m;
});

    • Test your custom node with SSTI payloads during CI/CD:

      npm test -- --grep "SSTI"

    What Undercode Say

    • Key Takeaway 1: Server-Side Template Injection is not a legacy issue – it’s actively compromising modern automation platforms. CVE-2026-27493 proves that even zero-click RCE is possible when developers assume template engines are safe.
    • Key Takeaway 2: Mitigation requires a layered approach: version upgrades, input sanitization, least-privilege execution, and WAF rules. Relying solely on patches leaves a window of exposure.

    The n8n vulnerability underscores a recurring pattern: user-controlled data flowing into dynamic code evaluation. While the immediate fix is upgrading, organizations must also audit all Form nodes, implement strict CSP headers, and monitor for anomalous process creation. The exploit chain – from `{{77}}` to `child_process.execSync(‘id’)` – is trivial to execute, making this a high-priority patch. Developers should treat any template engine that evaluates expressions as a potential RCE vector, especially when exposed to unauthenticated users. Remember: sandbox escapes are inevitable; the real defense is never putting user input into a privileged evaluation context.

    Prediction

    Within six months, we will see mass scanning for n8n Form endpoints and automated exploitation of CVE-2026-27493, leading to a wave of cryptocurrency miner deployments and data exfiltration campaigns. Organizations that delay patching beyond 30 days face near-certain compromise. The vulnerability will also inspire similar SSTI-to-RCE discoveries in other low-code platforms (Zapier, Make, Airbyte) as researchers shift focus to automation tools. Expect the next generation of WAFs to include SSTI-specific signatures, and n8n will likely introduce a “safe mode” that disables all dynamic expression evaluation in public-facing nodes.

    ▶️ Related Video (84% Match):

    🎯Let’s Practice For Free:

    IT/Security Reporter URL:

    Reported By: Omar Aljabr – Hackers Feeds
    Extra Hub: Undercode MoN
    Basic Verification: Pass ✅

    🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

    💬 Whatsapp | 💬 Telegram

    📢 Follow UndercodeTesting & Stay Tuned:

    𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Related Posts: