AutomationFlowsAI & RAG › Automate Cve Detection with Ai-powered Nuclei Template Generation & Google Drive

Automate Cve Detection with Ai-powered Nuclei Template Generation & Google Drive

ByJavier Rieiro @pyus3r on n8n.io

Automates collection, technical extraction, and automatic generation of Nuclei templates from public CVE PoCs. Converts verified PoCs into reproducible detection templates ready for testing and distribution.

Cron / scheduled trigger★★★★☆ complexityAI-powered27 nodesSshHTTP RequestAgentHTTP Request ToolOpenAI ChatGoogle Drive
AI & RAG Trigger: Cron / scheduled Nodes: 27 Complexity: ★★★★☆ AI nodes: yes Added:

This workflow corresponds to n8n.io template #10446 — we link there as the canonical source.

This workflow follows the Agent → Google Drive recipe pattern — see all workflows that pair these two integrations.

The workflow JSON

Copy or download the full n8n JSON below. Paste it into a new n8n workflow, add your credentials, activate. Full import guide →

Download .json
{
  "meta": {
    "templateCredsSetupCompleted": true
  },
  "nodes": [
    {
      "id": "ce1e089b-d9f2-4953-bda6-53b741b44890",
      "name": "Schedule Trigger",
      "type": "n8n-nodes-base.scheduleTrigger",
      "position": [
        80,
        -208
      ],
      "parameters": {
        "rule": {
          "interval": [
            {}
          ]
        }
      },
      "typeVersion": 1.2
    },
    {
      "id": "30e08e1c-f461-4707-88fa-394bf9436a4d",
      "name": "Get CVEs PoC",
      "type": "n8n-nodes-base.ssh",
      "position": [
        304,
        -208
      ],
      "parameters": {
        "command": "/root/go/bin/vulnx search \"is_poc=true\" \"is_template=false\" \"cvss_score:>6.0\" \"age_in_days:<30\" \"is_kev=true\" --remote-exploit --detailed --sort-asc cvss_score"
      },
      "credentials": {
        "sshPassword": {
          "name": "<your credential>"
        }
      },
      "typeVersion": 1
    },
    {
      "id": "9dcceb2b-e2fc-45ff-8e0a-97638890ef2f",
      "name": "Split CVEs",
      "type": "n8n-nodes-base.code",
      "position": [
        512,
        -208
      ],
      "parameters": {
        "jsCode": "const input = items[0].json;\n\nconst stdout = input.stdout || '';\n\nconst entries = stdout.split(/\\n\\n\\[CVE-/).filter(e => e.trim() !== '');\n\nconst formatted = entries.map((e, i) => (i === 0 ? e : '[CVE-' + e));\n\nreturn formatted.map(entry => ({ json: { CVE: entry.trim() } }));"
      },
      "typeVersion": 2
    },
    {
      "id": "500f52b7-27d6-4e6d-9073-026bb56f52eb",
      "name": "Loop Over CVEs",
      "type": "n8n-nodes-base.splitInBatches",
      "position": [
        768,
        -208
      ],
      "parameters": {
        "options": {}
      },
      "typeVersion": 3
    },
    {
      "id": "adf27272-8aca-4f4d-86d3-dccd0c724c8c",
      "name": "Split CVEs Content",
      "type": "n8n-nodes-base.code",
      "position": [
        1008,
        16
      ],
      "parameters": {
        "jsCode": "const raw = items[0].json.CVE || items[0].json.stdout || '';\nif (!raw) return [{ json: { error: 'no-input-found' } }];\n\nconst lines = raw.split(/\\r?\\n/);\nconst joinTrim = arr => arr.map(s => s.trim()).filter(Boolean).join(' ');\nconst extractBracketCve = s => {\n  const m = s.match(/\\[CVE-[0-9\\-]+\\]/);\n  return m ? m[0].replace(/[\\[\\]]/g,'') : null;\n};\n\nlet cveId = extractBracketCve(raw);\nlet severity = null;\nlet title = null;\nlet metadata = {};\nlet sections = { Summary: [], Risk: [], Remediation: [], POCs: [], References: [], 'Affected Products': [] };\nlet currentSection = null;\n\nconst firstLine = lines.find(l => l.trim().length > 0) || '';\nconst mFirst = firstLine.match(/^\\[CVE-[^\\]]+\\]\\s*([A-Za-z]+)\\s*-\\s*(.+)$/);\nif (mFirst) { severity = mFirst[1].trim(); title = mFirst[2].trim(); }\n\nfor (const rawLine of lines) {\n  const line = rawLine.trim();\n  if (!line) continue;\n\n  if (/^\u21b3/.test(line) || line.includes('\u21b3')) {\n    const clean = line.replace(/^\u21b3\\s*/,'').trim();\n    const kv = clean.match(/^([^:]+):\\s*(.+)$/);\n    if (kv) metadata[kv[1].trim()] = kv[2].trim();\n    else metadata.misc = (metadata.misc ? metadata.misc + ' ' : '') + clean;\n    continue;\n  }\n\n  if (/^Summary\\b/i.test(line)) { currentSection = 'Summary'; continue; }\n  if (/^Risk\\b/i.test(line)) { currentSection = 'Risk'; continue; }\n  if (/^Remediation\\b/i.test(line)) { currentSection = 'Remediation'; continue; }\n  if (/^POC|^POCs\\b/i.test(line)) { currentSection = 'POCs'; continue; }\n  if (/^References\\b/i.test(line)) { currentSection = 'References'; continue; }\n  if (/^Affected Products\\b/i.test(line)) { currentSection = 'Affected Products'; continue; }\n\n  if (currentSection) {\n    const clean = line.replace(/^\u2192\\s*/,'').trim();\n    sections[currentSection].push(clean);\n    continue;\n  }\n\n  const m = line.match(/^\\[CVE-[^\\]]+\\]\\s*([A-Za-z]+)\\s*-\\s*(.+)$/);\n  if (m && (!severity || !title)) { severity = m[1].trim(); title = m[2].trim(); }\n}\n\nconst results = [];\n\nif (cveId) results.push({ json: { CVE: cveId } });\nif (severity) results.push({ json: { Severity: severity } });\nif (title) results.push({ json: { Title: title } });\n\nfor (const k of Object.keys(metadata)) {\n  results.push({ json: { [k]: metadata[k] } });\n}\n\nfor (const sec of ['Summary','Risk','Remediation']) {\n  const v = joinTrim(sections[sec]);\n  if (v) results.push({ json: { [sec]: v } });\n}\nfor (const sec of ['POCs','References','Affected Products']) {\n  const arr = sections[sec].filter(Boolean);\n  if (arr.length) results.push({ json: { [sec]: arr } });\n}\n\nreturn results;"
      },
      "typeVersion": 2
    },
    {
      "id": "726fc135-2064-4f8a-acf8-ee0cf2d63328",
      "name": "Split PoC",
      "type": "n8n-nodes-base.splitOut",
      "position": [
        1264,
        16
      ],
      "parameters": {
        "options": {},
        "fieldToSplitOut": "POCs"
      },
      "typeVersion": 1
    },
    {
      "id": "e6a8d4f3-1ef3-4c68-8ed1-d2aa8217e927",
      "name": "URL Regex",
      "type": "n8n-nodes-base.code",
      "position": [
        1536,
        16
      ],
      "parameters": {
        "jsCode": "// input: items de n8n\nconst urlRegex = /(https?:\\/\\/[^\\s)]+)/g;\n\nconst results = [];\n\nitems.forEach(item => {\n    for (const key in item.json) {\n        const value = item.json[key];\n        if (typeof value === 'string') {\n            const matches = value.match(urlRegex);\n            if (matches) {\n                matches.forEach(url => results.push({ json: { url } }));\n            }\n        }\n    }\n});\n\nreturn results;\n"
      },
      "typeVersion": 2
    },
    {
      "id": "a48c4579-a99a-445c-a73f-04e033ac7c16",
      "name": "Loop Over URLs",
      "type": "n8n-nodes-base.splitInBatches",
      "position": [
        1824,
        -224
      ],
      "parameters": {
        "options": {}
      },
      "typeVersion": 3
    },
    {
      "id": "f480e7fd-b4f9-4afc-b182-b3c01a7c7732",
      "name": "Validate URL",
      "type": "n8n-nodes-base.httpRequest",
      "onError": "continueRegularOutput",
      "position": [
        2032,
        -144
      ],
      "parameters": {
        "url": "={{ $json.url }}",
        "options": {}
      },
      "typeVersion": 4.2
    },
    {
      "id": "f2f239b2-41cd-4c68-9fb1-5e627353bc21",
      "name": "URL Filter",
      "type": "n8n-nodes-base.if",
      "position": [
        2240,
        -144
      ],
      "parameters": {
        "options": {},
        "conditions": {
          "options": {
            "version": 2,
            "leftValue": "",
            "caseSensitive": true,
            "typeValidation": "strict"
          },
          "combinator": "and",
          "conditions": [
            {
              "id": "cacebb0d-f918-411c-bc40-d1ff4e6c977a",
              "operator": {
                "type": "string",
                "operation": "exists",
                "singleValue": true
              },
              "leftValue": "={{ $json.data }}",
              "rightValue": ""
            }
          ]
        }
      },
      "typeVersion": 2.2
    },
    {
      "id": "1c4a8b31-e64f-47be-acaa-9420c229921d",
      "name": "Summarize PoC",
      "type": "@n8n/n8n-nodes-langchain.agent",
      "position": [
        2448,
        -160
      ],
      "parameters": {
        "text": "=With this url {{ $('Loop Over URLs').item.json.url }}: Extract and preserve all technical details, including script codes, steps, POCs, endpoints, raw HTTP requests, and responses related to the identified vulnerabilities. Ensure the inclusion of specific details such as parameters, URLs, payloads, and response behaviors critical for understanding and replicating the issues. Avoid general commentary and non-technical content.\\n\\nTitle: {page_title}\\nContext: {combined_content}",
        "options": {},
        "promptType": "define"
      },
      "typeVersion": 2.2
    },
    {
      "id": "b6f0cb73-8b8c-40da-b4fa-3530dc8781ad",
      "name": "URL PoC Info",
      "type": "n8n-nodes-base.httpRequestTool",
      "position": [
        2624,
        32
      ],
      "parameters": {
        "url": "={{ $('Loop Over URLs').item.json.url }}",
        "options": {}
      },
      "typeVersion": 4.2
    },
    {
      "id": "ac2d83b1-5621-4594-a0e1-e74a53a941a9",
      "name": "AI Generate Nuclei Template",
      "type": "n8n-nodes-base.httpRequest",
      "onError": "continueRegularOutput",
      "position": [
        2816,
        -160
      ],
      "parameters": {
        "url": "https://api.projectdiscovery.io/v1/template/ai",
        "method": "POST",
        "options": {},
        "sendBody": true,
        "sendHeaders": true,
        "bodyParameters": {
          "parameters": [
            {
              "name": "prompt",
              "value": "={{ $json.output }}"
            }
          ]
        },
        "headerParameters": {
          "parameters": [
            {
              "name": "X-API-Key",
              "value": "eae09816-02dc-4327-b493-75c6e131de49"
            }
          ]
        }
      },
      "typeVersion": 4.2
    },
    {
      "id": "f4932ac8-13c2-4c1e-b023-37322f8d29e9",
      "name": "Validate Response",
      "type": "n8n-nodes-base.if",
      "position": [
        3008,
        0
      ],
      "parameters": {
        "options": {},
        "conditions": {
          "options": {
            "version": 2,
            "leftValue": "",
            "caseSensitive": true,
            "typeValidation": "strict"
          },
          "combinator": "and",
          "conditions": [
            {
              "id": "2c7077cb-d9c3-4bd7-89b1-f4f0604b7a5a",
              "operator": {
                "type": "string",
                "operation": "exists",
                "singleValue": true
              },
              "leftValue": "={{ $json.completion }}",
              "rightValue": ""
            }
          ]
        }
      },
      "typeVersion": 2.2
    },
    {
      "id": "8a92007d-fcd1-4a45-913e-5f2d936268cf",
      "name": "OpenAI Chat Model",
      "type": "@n8n/n8n-nodes-langchain.lmChatOpenAi",
      "position": [
        2416,
        32
      ],
      "parameters": {
        "model": {
          "__rl": true,
          "mode": "list",
          "value": "gpt-4.1-mini"
        },
        "options": {}
      },
      "credentials": {
        "openAiApi": {
          "name": "<your credential>"
        }
      },
      "typeVersion": 1.2
    },
    {
      "id": "df64c05f-9a06-4eef-83f6-98f033a732e2",
      "name": "Upload Nuclei Template",
      "type": "n8n-nodes-base.googleDrive",
      "position": [
        2032,
        -320
      ],
      "parameters": {
        "name": "={{ $json.name }}",
        "content": "={{ $json.completion }}",
        "driveId": {
          "__rl": true,
          "mode": "list",
          "value": "My Drive"
        },
        "options": {},
        "folderId": {
          "__rl": true,
          "mode": "list",
          "value": "1FK59BOBN_flPPETUfQ8Kg4F25WXbWyMW",
          "cachedResultUrl": "https://drive.google.com/drive/folders/1FK59BOBN_flPPETUfQ8Kg4F25WXbWyMW",
          "cachedResultName": "Nuclei Template Generator"
        },
        "operation": "createFromText"
      },
      "credentials": {
        "googleDriveOAuth2Api": {
          "name": "<your credential>"
        }
      },
      "typeVersion": 3
    },
    {
      "id": "4aa088fc-74bf-48af-868a-4a40a2254ce8",
      "name": "Sticky Note",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -32,
        -544
      ],
      "parameters": {
        "color": 7,
        "width": 3248,
        "height": 832,
        "content": ""
      },
      "typeVersion": 1
    },
    {
      "id": "b79e9c8d-603c-4a76-80b6-f9a99171dbf6",
      "name": "Sticky Note9",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -32,
        176
      ],
      "parameters": {
        "color": 6,
        "width": 720,
        "height": 112,
        "content": "# \ud83d\udcec Need Help or Want to Customize This?\n## **Contact me for consulting and support:** [LinkedIn](https://www.linkedin.com/in/javier-rieiro-2900b5354/) / [Email](mailto:pyus3r@gmail.com)"
      },
      "typeVersion": 1
    },
    {
      "id": "7f8277eb-878c-4081-aa1f-3bb7d74bee7b",
      "name": "Sticky Note5",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -768,
        -544
      ],
      "parameters": {
        "width": 736,
        "height": 832,
        "content": "# \u2699\ufe0f SET UP\n\n## \ud83e\uddf0 1. Set Up ProjectDiscovery API\n### \ud83d\udd11 ProjectDiscovery API\n1. Go to [**ProjectDiscovery Cloud Platform**](https://cloud.projectdiscovery.io/).  \n2. Log in or create an account.  \n3. Open **Settings \u2192 API Keys**.  \n4. Click **Generate New API Key**.  \n5. \ud83d\udccb Copy the generated key.  \n6. In **n8n**, go to **Credentials \u2192 New \u2192 HTTP Request**.  \n7. Configure as follows:  \n   - **Authentication:** Header Auth  \n   - **Name:** `PD-API-Key`  \n   - **Value:** *(paste your ProjectDiscovery API key)*  \n8. \ud83d\udcbe Save your credentials.  \n9. \ud83e\uddea Test the connection with an HTTP Request node (e.g., `GET https://api.projectdiscovery.io`).\n---\n\n## \ud83e\udd16 2. Set Up OpenAI Connection\n### \ud83d\udd10 Get Your API Key\n1. Visit the [\ud83d\udd17 OpenAI API Keys](https://platform.openai.com/api-keys) page.  \n2. Go to [\ud83d\udcb3 OpenAI Billing](https://platform.openai.com/settings/organization/billing/overview).  \n3. Add funds to your billing account.  \n4. \ud83d\udce5 Copy your API key and paste it into your **OpenAI credentials** in n8n (or your chosen platform).  \n---\n\n## \u2601\ufe0f 3. Set Up Google Drive\n- [n8n docs](https://docs.n8n.io/integrations/builtin/credentials/google/oauth-single-service/?utm_source=n8n_app&utm_medium=credential_settings&utm_campaign=create_new_credentials_modal)\n---\n\n## \ud83e\udde9 4. Set Up SSH Environment\n- [n8n docs](https://docs.n8n.io/integrations/builtin/credentials/ssh/?utm_source=n8n_app&utm_medium=credential_settings&utm_campaign=create_new_credentials_modal)"
      },
      "typeVersion": 1
    },
    {
      "id": "025fd07e-08c7-4b31-8dfb-1f5cf674a0c5",
      "name": "Sticky Note6",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -32,
        -544
      ],
      "parameters": {
        "color": 5,
        "width": 528,
        "height": 208,
        "content": "## Next Steps\n\n- Download Template\n\n- Nuclei (Guide --> https://projectdiscovery.io/blog/ultimate-nuclei-guide)\n```\nnuclei -u https://example.com -t CVE-2025-34533.yaml\n```\n\n"
      },
      "typeVersion": 1
    },
    {
      "id": "6919a161-46db-4149-80ad-87aefc182f0e",
      "name": "Sticky Note7",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        496,
        -544
      ],
      "parameters": {
        "color": 2,
        "width": 528,
        "height": 208,
        "content": "## Get CVEs PoC Tips\n\n- Parameters available: `cvss_min`, `max_age`, `include_exploits`\n- Use expressions to build the command dynamically\n- Filter and send high-severity CVEs to Slack or email\n"
      },
      "typeVersion": 1
    },
    {
      "id": "47b7574c-aab7-4a55-8ab9-b80881065b91",
      "name": "Sticky Note1",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        256,
        -256
      ],
      "parameters": {
        "color": 4,
        "width": 400,
        "height": 208,
        "content": ""
      },
      "typeVersion": 1
    },
    {
      "id": "34c9ab69-9da9-45eb-859c-1a429fcabf2d",
      "name": "Sticky Note2",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        720,
        -256
      ],
      "parameters": {
        "color": 5,
        "width": 960,
        "height": 448,
        "content": ""
      },
      "typeVersion": 1
    },
    {
      "id": "0ace2527-3e59-4151-84f3-3f194e96df1b",
      "name": "Sticky Note3",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        1776,
        -368
      ],
      "parameters": {
        "width": 1376,
        "height": 560,
        "content": ""
      },
      "typeVersion": 1
    },
    {
      "id": "a476cea4-7e4b-44d2-963c-a3def7419f7a",
      "name": "Sticky Note4",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        1136,
        -480
      ],
      "parameters": {
        "color": 4,
        "width": 166,
        "height": 80,
        "content": "## Get CVEs with cvemap"
      },
      "typeVersion": 1
    },
    {
      "id": "a6c13ec1-9e0f-4951-8427-d00a2d74750f",
      "name": "Sticky Note8",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        1360,
        -480
      ],
      "parameters": {
        "color": 5,
        "width": 150,
        "height": 80,
        "content": "## Get PoCs"
      },
      "typeVersion": 1
    },
    {
      "id": "32585723-46b6-40c1-a299-84a80ce6d11e",
      "name": "Sticky Note10",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        1568,
        -512
      ],
      "parameters": {
        "width": 400,
        "height": 80,
        "content": "## Generate Nuclei Template with AI Agent & Proyect Discovery API"
      },
      "typeVersion": 1
    }
  ],
  "connections": {
    "Split PoC": {
      "main": [
        [
          {
            "node": "URL Regex",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "URL Regex": {
      "main": [
        [
          {
            "node": "Loop Over CVEs",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Split CVEs": {
      "main": [
        [
          {
            "node": "Loop Over CVEs",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "URL Filter": {
      "main": [
        [
          {
            "node": "Summarize PoC",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Loop Over URLs",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Get CVEs PoC": {
      "main": [
        [
          {
            "node": "Split CVEs",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "URL PoC Info": {
      "ai_tool": [
        [
          {
            "node": "Summarize PoC",
            "type": "ai_tool",
            "index": 0
          }
        ]
      ]
    },
    "Validate URL": {
      "main": [
        [
          {
            "node": "URL Filter",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Summarize PoC": {
      "main": [
        [
          {
            "node": "AI Generate Nuclei Template",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Loop Over CVEs": {
      "main": [
        [
          {
            "node": "Loop Over URLs",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Split CVEs Content",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Loop Over URLs": {
      "main": [
        [
          {
            "node": "Upload Nuclei Template",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Validate URL",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Schedule Trigger": {
      "main": [
        [
          {
            "node": "Get CVEs PoC",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "OpenAI Chat Model": {
      "ai_languageModel": [
        [
          {
            "node": "Summarize PoC",
            "type": "ai_languageModel",
            "index": 0
          }
        ]
      ]
    },
    "Validate Response": {
      "main": [
        [
          {
            "node": "Loop Over URLs",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Loop Over URLs",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Split CVEs Content": {
      "main": [
        [
          {
            "node": "Split PoC",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "AI Generate Nuclei Template": {
      "main": [
        [
          {
            "node": "Validate Response",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

Credentials you'll need

Each integration node will prompt for credentials when you import. We strip credential IDs before publishing — you'll add your own.

Pro

For the full experience including quality scoring and batch install features for each workflow upgrade to Pro

About this workflow

Automates collection, technical extraction, and automatic generation of Nuclei templates from public CVE PoCs. Converts verified PoCs into reproducible detection templates ready for testing and distribution.

Source: https://n8n.io/workflows/10446/ — original creator credit. Request a take-down →

More AI & RAG workflows → · Browse all categories →

Related workflows

Workflows that share integrations, category, or trigger type with this one. All free to copy and import.

AI & RAG

This n8n automation workflow automates the creation, scripting, production, and posting of YouTube videos. It leverages AI (OpenAI), image generation (PIAPI), video rendering (Shotstack), and platform

Agent, OpenAI Chat, Airtable Tool +7
AI & RAG

This workflow is designed for: Content creators and marketers E-commerce and product-based businesses Agencies producing social media visuals and videos Automation builders looking for AI-powered crea

HTTP Request, Edit Image, Google Drive +7
AI & RAG

Generate product images with NanoBanana Pro to Veo videos and Blotato - vide 2 ok. Uses httpRequest, editImage, googleDrive, googleSheets. Scheduled trigger; 76 nodes.

HTTP Request, Edit Image, Google Drive +7
AI & RAG

This workflow is for beauty salons who want consistent, high‑quality social media content without writing every post manually. It also suits agencies and automation builders who manage multiple beauty

Telegram, Google Sheets Trigger, Agent +26
AI & RAG

The Multi-Model Agency Content Engine is a high-performance editorial system designed for agencies. It solves the "blank page" problem by alternating between real-world social proof and strategic expe

Google Sheets, Gmail, Google Drive +6