CVE-2026-54301

n8n: Same-Origin XSS in Respond to Webhook Node

State: Published
Severity: 7.0 High
Published: Jun 23, 2026
Updated: Jun 24, 2026
Reserved: Jun 12, 2026

Description

n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, an authenticated user with workflow edit access could configure a Respond to Webhook node to serve binary content with an attacker-controlled Content-Type. The binary response path bypassed the central Content-Security-Policy sandbox header, allowing a public webhook to execute JavaScript in the n8n origin when visited by an authenticated user, with access to that user's session. This vulnerability is fixed in 1.123.55, 2.25.7, and 2.26.2.

Scores

CVSS	Score	Vector	Source
4.0	7.0 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
n8nn8n-io	< 1.123.55Affected >= 2.0.0-rc.0, < 2.25.7Affected >= 2.26.0, < 2.26.2Affected

References

https://github.com/n8n-io/n8n/security/advisories/GHSA-v733-mwr6-fgcm

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.