CVE-2026-56356

n8n - Stored Cross-Site Scripting in Chat Trigger Node Custom CSS Field

State: Published
Severity: 5.1 Medium
Published: Jun 30, 2026
Updated: Oct 29, 2026
Reserved: Jun 20, 2026

Description

n8n contains a stored cross-site scripting vulnerability in the Chat Trigger node's Custom CSS field due to a misconfiguration of the sanitize-html library. Affected releases are those before 1.123.27, the 2.0.0 through 2.13.2 line, and 2.14.0 (fixed in 1.123.27, 2.13.3, and 2.14.1). An authenticated user with permission to create or modify workflows can inject JavaScript that bypasses sanitization, resulting in stored XSS against any user who visits the public chat page.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N	VulnCheck
3.1	5.4 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	VulnCheck

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
n8nn8n	before 1.123.27Affected 1.123.27Not affected 2.0.0-rc.0 to before 2.13.3Affected 2.13.3Not affected 2.14.0 to before 2.14.1Affected 2.14.1Not affected
n8nn8n	2.14.0 to before 2.14.1Affected 2.14.1Not affected
n8nn8n	2.0.0-rc.0 to before 2.13.3Affected 2.13.3Not affected

References

GitHub Security Advisory (GHSA-3c7f-5hgj-h279)vendor-advisory
VulnCheck Advisory: n8n - Stored Cross-Site Scripting in Chat Trigger Node Custom CSS Fieldthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.