CVE-2026-54302

n8n: Stored XSS in Chat Trigger Node

State: Published
Severity: 7.0 High
Published: Jun 23, 2026
Updated: Jun 23, 2026
Reserved: Jun 12, 2026

Description

n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, an authenticated user with workflow edit access could inject arbitrary JavaScript into the Chat Trigger's generated page by setting a malicious webhookId. When a logged-in user visited the chat URL, the injected code executed in the n8n origin with that user's session privileges. This vulnerability is fixed in 1.123.55, 2.25.7, and 2.26.2.

Scores

CVSS	Score	Vector	Source
4.0	7.0 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
n8nn8n-io	< 1.123.55Affected >= 2.0.0-rc.0, < 2.25.7Affected >= 2.26.0, < 2.26.2Affected

References

https://github.com/n8n-io/n8n/security/advisories/GHSA-42h7-m79w-wvg5

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.