Aggregator

CVE-2026-27498：n8n组合拳RCE三功能叠加实现权限接管

先知技术社区
1 month 3 weeks ago
漏洞来源漏洞描述n8n 是一个开源工作流自动化平台。在 2.2.0 和 1.123.8 版本之前，拥有创建或修改工作流权限的已认证用户可以利用 git 操作链接“从磁盘读取/写入文件”节点，从而实现远程代码执行。攻击者通过写入特定的配置文件并触发 git 操作，即可在 n8n 主机上执行任意 shell 命令。此问题已在 n8n 2.2.0 和 1.123.8 版本中修复。用户应升级到这些版本或更

Weekly Update 501

Troy Hunt
1 month 3 weeks ago

This is so "peak 2026" - writing an equality policy to ensure people treat our AI bot with the same respect as they do their human counterparts. It's intentionally a bit tongue-in-cheek, but it's there for a purpose: we simply don't

Troy Hunt

CVE-2025-41660

CVE Trends
1 month 3 weeks ago
Currently trending CVE - Hype Score: 7 - A low-privileged remote attacker may be able to replace the boot application of the CODESYS Control runtime system, enabling unauthorized code execution.

Managed ad