EUVD-2026-42887
GHSA-qmq2-xjjf-5ffp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L reflects required workflow-creation authentication; S:C and UI:R capture downstream form-visitor impact; no availability impact applies.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
n8n before 1.123.24, 2.10.4, and 2.12.0 (across its 1.x and 2.x branches) contains cross-site scripting and open redirect vulnerabilities in the Form Node due to unsanitized HTML description fields and overly permissive iframe sandbox policies. Authenticated users with workflow creation permissions can inject malicious scripts or redirect parameters to perform stored XSS attacks or phishing redirects against end users.
AnalysisAI
Stored cross-site scripting and open redirect vulnerabilities in n8n's Form Node allow authenticated users with workflow creation permissions to inject malicious scripts or phishing redirects that execute in the browsers of end users who interact with published forms. Affected across both the 1.x branch (before 1.123.24) and the 2.x branch (before 2.10.4 and 2.12.0). The attack surface is the Form Node's HTML description fields, which accept unsanitized markup, combined with an overly permissive iframe sandbox policy - creating a persistent attack vector embedded within legitimate workflows. No public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
n8n is a self-hostable workflow automation platform (cpe:2.3:a:n8n:n8n) that allows users to build data pipelines and forms via a visual node-based editor. The Form Node renders HTML-capable description fields and embeds iframes to display forms to external end users. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), manifesting in two ways: first, user-supplied HTML in description fields is not sanitized before rendering in the form's output context; second, the iframe sandbox attribute is configured too permissively, failing to restrict script execution or navigation originating from form content. Because form output is served to arbitrary end users (not just n8n operators), a stored XSS payload placed in a workflow persists and fires against every user who loads the associated form URL.
RemediationAI
Upgrade n8n to version 1.123.24 or later on the 1.x branch, or to 2.10.4 / 2.12.0 or later on the 2.x branch, per the vendor security advisory at https://github.com/n8n-io/n8n/security/advisories/GHSA-w673-8fjw-457c. If an immediate upgrade is not possible, restrict workflow creation permissions to fully trusted internal users only - removing this access from any semi-trusted or shared accounts eliminates the authenticated attack path. As a further compensating control, audit existing workflows for Form Nodes that contain raw HTML in description fields and sanitize or remove such content. Organizations exposing n8n Form URLs to external or anonymous end users should treat this as elevated priority until patched, as those users are the impacted downstream targets.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today