RSSAmplifier

Simon Koeck · Aug 16, 2026

From a Schema Name to RCE in n8n

0
Sign in to vote or save

This site does not allow itself to be embedded. You can still read it on the original site — the toolbar below keeps your place in the directory.

n8n uses a user-supplied schema name as a bare object key. Set it to __proto__, pollute the prototype, chain into RCE via the Git node. One request, full shell.

Read on simonkoeck.com

Comments

Nothing yet. Say the first thing.

    Sign in to join the conversation.