cve-exploit-engine

An automated CVE monitoring and exploit workflow generator built with n8n. Fetches real-time vulnerabilities from NVD, OSV.dev and Exploit-DB every 4 hours, enriches them with attack methodology, and sends prioritised Slack alerts.

---

What it does

• Pulls new CVEs every 4 hours from 3 sources (NVD, OSV.dev, Exploit-DB)
• Deduplicates and normalises all data into a flat schema
• Auto-generates attack steps and testing focus for each CVE based on keyword detection
• Routes CVEs into 3 severity lanes (PoC exploit / Critical / High)
• Sends formatted Slack alerts to #cve-alerts with full exploit methodology

---

Workflow architecture

Schedule Trigger (every 4h)
  → Fetch OSV Vulns       (POST api.osv.dev)
  → Fetch NVD CVEs        (GET services.nvd.nist.gov)
  → Fetch Exploit-DB RSS  (GET exploit-db.com/rss.xml)
  → Normalise CVE Data    (Code node — dedupe + flatten)
  → Exploit Workflow Generator (Code node — attack methodology)
  → Route by Severity     (Switch node)
      → Output 0: PoC exists    → Slack 🟣
      → Output 1: CVSS ≥ 9      → Slack 🔴
      → Output 2: CVSS ≥ 7      → Slack 🟡

---

Vulnerability types detected

The Exploit Workflow Generator automatically detects and generates methodology for:

Keyword detected	Attack generated
xss, cross-site scripting	XSS payload injection
sql, injection	SQL injection testing
upload, file	Malicious file upload
api	API endpoint fuzzing
rce, remote code, command	Remote code execution
ssrf	Server-side request forgery
csrf	CSRF token testing
path, traversal, directory	Path traversal payloads
auth, bypass	Authentication bypass
overflow, buffer	Memory corruption analysis
privilege, escalation	Privilege escalation paths
deserialization	Insecure deserialization

---

Example Slack alert

🟣 PoC EXPLOIT DETECTED — EDB-52486
[webapps] WordPress Backup Migration 1.3.7 - Remote Command Execution
CVSS: 9.0 | Exploit-DB

⚔️ Attack steps:
• Attempt remote code execution
• Test file upload with malicious files

🎯 Testing focus:
• Test command injection via OS commands
• Try SVG, HTML, PHP, polyglot files

🔗 https://www.exploit-db.com/exploits/52486

---

Setup

Prerequisites

• n8n (cloud or self-hosted)
• Slack workspace with a bot token (xoxb-)
• A #cve-alerts channel in your Slack workspace

Import workflow

1. Download cve-exploit-engine.json
2. In n8n → click + → Import from file
3. Upload the JSON file
4. Add your Slack credential (OAuth or xoxb- token)
5. Set the channel to your #cve-alerts channel name
6. Click Publish

Run locally for free

npx n8n

Open http://localhost:5678 and import the workflow JSON.

---

Data sources

Source	Type	What it covers
NVD (NIST)	JSON API	Official US CVE database — most complete
OSV.dev	REST API	Open source package vulnerabilities
Exploit-DB	RSS feed	Published PoC exploits

---

Self-hosting (free forever)

Option 1 — Local (npx)

npx n8n
# Open http://localhost:5678

Option 2 — Docker

docker run -it --rm \
  --name n8n \
  -p 5678:5678 \
  -v ~/.n8n:/home/node/.n8n \
  n8nio/n8n

Option 3 — Oracle Cloud Free Tier

Create a free VM at cloud.oracle.com → install Docker → run the Docker command above. Runs 24/7 for free forever.

---

Built with

• n8n — workflow automation
• NVD API — CVE data
• OSV.dev API — open source vuln data
• Exploit-DB RSS — exploit feed
• Slack API — notifications

---

License

MIT — free to use, modify and distribute.