n8n CVE-2026-110847

Exploitation requires an authenticated n8n workflow author (PR:L) who creates a Chat Trigger node and supplies a malicious customCss value, which is then interpolated unsanitized into the hosted-chat page markup. The payload only executes when a victim - a signed-in n8n user whose session shares the instance origin - actually loads the published chat page (UI:P/passive interaction), making a signed-in visitor a hard prerequisite. A key amplifier is that the chat can be published without n8n user authentication, so any visitor can reach the page, but impact (session/origin access) lands only on authenticated visitors. Limiting factors: single-user/single-operator instances where the only author is also the sole trusted admin face minimal real exposure; the attacker cannot act without workflow-authoring privileges, and no impact occurs without a victim visit. Only affects n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1.

This is a moderate-severity stored XSS (CVSS 4.0 base 7.0, CWE-79) whose real-world priority is bounded by its access model rather than its network vector. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H) indicates network reach and low attack complexity, but two signals temper it: PR:L means the attacker must already be an authenticated n8n workflow author, and UI:P means a signed-in victim must visit the attacker's published hosted-chat page for the payload to fire. The elevated VC:H (high confidentiality impact) reflects that execution on the instance origin can compromise the sessions of signed-in visitors (session/token theft, potential account takeover), while VI:L/VA:N keep integrity and availability impact low. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no evidence of active or widespread exploitation. The notable nuance is that n8n permits publishing a chat WITHOUT n8n user authentication for the chat itself - so while the vector requires a privileged author to plant the payload, the delivery surface to victims is unauthenticated, raising the practical reach once a malicious workflow exists (e.g., in multi-tenant or shared instances). Net: a real but second-tier priority - patch promptly on multi-user/shared instances, lower urgency on single-operator deployments where the author and admin are the same trusted party.

A workflow author on a shared or multi-tenant n8n instance creates a Chat Trigger and sets a crafted customCss value that is interpolated as markup into the hosted-chat page. When a signed-in n8n user (e.g., an administrator) visits that published chat page, the injected script executes on the instance origin and can exfiltrate session cookies or tokens, enabling account takeover. No public exploit identified at time of analysis, so weaponization effort would fall on the attacker.