CVE-2026-44789-n8n-PrototypePollution-RCE

CVE-2026-44789 — n8n <1.123.43 HTTP Request pagination prototype pollution to RCE (NODE_OPTIONS runner-spawn gadget). Lab + automated PoC, verified e2e.

The public advisory states only that the pollution "combined with other techniques could lead to RCE" — it does not disclose a gadget. This repo documents and automates a concrete, verified prototype-pollution→RCE chain.

1. The pollution primitive

packages/nodes-base/nodes/HttpRequest/V3/HttpRequestV3.node.ts, pagination mode updateAParameterInEachRequest:

parameter.type, parameterName and parameterValue all come from the workflow JSON (attacker-controlled). With parameter.type = "__proto__", paginationData.request["__proto__"] resolves to Object.prototype, so the assignment writes Object.prototype[parameterName] = parameterValue — a global prototype pollution in the n8n server process.

The fix uses Object.create(null) for paginationData.request, so ["__proto__"] is an ordinary (null-proto) key instead of the prototype.

2. The RCE gadget

packages/cli/src/task-runners/task-runner-process-js.ts spawns the JS task runner:

Node's normalizeSpawnArguments builds the child environment with for (const key in env), which enumerates inherited enumerable properties. Polluting Object.prototype.NODE_OPTIONS = "--require=/path/evil.js" therefore leaks into the spawned runner's environment. The child is node, which honours NODE_OPTIONS, so it --requires the attacker's file at startup → code execution outside the Code-node sandbox, as the n8n service user.

The runner is launched at startup, but its lifecycle re-spawns it whenever the process exits (onProcessExit → start()). The attacker forces a respawn after polluting by hanging the runner with a Code node (task-timeout / OOM kills it).

3. End-to-end chain (what exploit.py does)

Ordering matters: the pollution makes NODE_OPTIONS an enumerable own-less key on Object.prototype, which n8n's TypeORM layer trips over (for…in over entities), breaking workflow persistence. So the runner must already be hung before the pollution lands; the respawn then picks up the polluted environment.

4. Reproduce

Configuration scope (read first). The prototype-pollution primitive fires on any affected version with no configuration changes. The RCE gadget needs the task runner, which is reached differently per branch:

• n8n 2.x affected (2.0.0–2.20.6, 2.21.0–2.22.0): task runners are default/mandatory (N8N_RUNNERS_ENABLED is deprecated → SAFE_TO_REMOVE), so the full RCE chain is default configuration.
• n8n 1.123.x affected (this lab image): task runners default to off, so the lab sets N8N_RUNNERS_ENABLED=true to mirror the 2.x default. N8N_RUNNERS_TASK_TIMEOUT is lowered only to make the hung-runner respawn fire faster — it is not required for the bug.

exploit.py uses only the Python standard library and drives the n8n REST API end-to-end (owner setup/login → deploy workflows → fire the chain).

Observed:

uid=1000(node) is the runner's service account and the output is live id/uname state — genuine execution, not input echo.

5. Impact

Any authenticated user who can create or modify a workflow gains OS command execution on the n8n host, escaping the Code-node sandbox — full compromise of the automation server and every credential/system it can reach.

6. Remediation

• Upgrade to n8n ≥ 1.123.43 / 2.20.7 / 2.22.1 (the pagination object is built with Object.create(null), killing the __proto__ write).
• Defense in depth: restrict workflow create/modify to trusted users; the runner is already hardened with --disable-proto=delete / --disallow-code-generation-from-strings, but those protect the runner, not the main process where the pollution lands.

7. Detection

Flag workflows whose HTTP Request pagination parameters use type values of __proto__ / constructor / prototype, and NODE_OPTIONS appearing as an entity property error in n8n/TypeORM logs.

See ANALYSIS.md for the primitive, the Node for…in env behaviour, the runner lifecycle, and the patch.

• Author: Caio Fabrício — github.com/BiiTts
• Vulnerability credit belongs to the original reporter / vendor advisory; the pollution→RCE gadget chain here is independent research. For authorized security testing only.