n8n-io n8n up to 1.123.8/2.2.0 cross site scripting

Summaryinfo

A vulnerability was found in n8n-io n8n up to 1.123.8/2.2.0. It has been classified as problematic. Affected by this vulnerability is an unknown functionality. This manipulation causes cross site scripting. This vulnerability is tracked as CVE-2026-25054. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as problematic was found in n8n-io n8n up to 1.123.8/2.2.0. Affected by this vulnerability is an unknown code block. The manipulation with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-80. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. As an impact it is known to affect integrity. The summary by CVE is:

n8n is an open source workflow automation platform. Prior to versions 1.123.9 and 2.2.1, a Cross-Site Scripting (XSS) vulnerability existed in a markdown rendering component used in n8n's interface, including workflow sticky notes and other areas that support markdown content. An authenticated user with permission to create or modify workflows could abuse this to execute scripts with same-origin privileges when other users interact with a maliciously crafted workflow. This could lead to session hijacking and account takeover. This issue has been patched in versions 1.123.9 and 2.2.1.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-25054 since 01/28/2026. The exploitation appears to be easy. The attack can be launched remotely. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1059.007 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 298989 (n8n Node.js Package < 1.123.9 / 2.x < 2.2.1 Stored XSS (CVE-2026-25054)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.123.9 or 2.2.1 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (298989) and CERT Bund (WID-SEC-2026-0318). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• n8n n8n

Productinfo

Vendor

• n8n-io

Name

• n8n

Version

• 1.123.0
• 1.123.1
• 1.123.2
• 1.123.3
• 1.123.4
• 1.123.5
• 1.123.6
• 1.123.7
• 1.123.8
• 2.0
• 2.1
• 2.2.0

Website

• Product: https://github.com/n8n-io/n8n/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion