EUVD-2026-42257
GHSA-c4mv-j7jv-9c8f
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L for required authentication, UI:R for mandatory victim click, S:C for cross-user session script execution, no availability impact applies.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
n8n before 2.8.0 contains a cross-site scripting vulnerability in the credential management flow where authenticated users can inject malicious JavaScript URLs into OAuth2 credential Authorization URL fields. Attackers can craft malicious credentials and trick victims into clicking the OAuth authorization button, executing arbitrary scripts in their browser session with the victim's privileges.
AnalysisAI
Stored cross-site scripting in n8n before 2.8.0 allows authenticated low-privilege users to inject malicious JavaScript URLs into OAuth2 credential Authorization URL fields within the credential management flow. When a victim - potentially a higher-privileged user - clicks the OAuth authorization button on the crafted credential, arbitrary scripts execute in their browser session carrying the victim's privileges. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the stored nature of the payload means a single malicious credential can be surfaced to multiple targets in collaborative n8n environments.
Technical ContextAI
n8n is an open-source, self-hosted and cloud-available workflow automation platform that allows users to configure integrations via credential objects, including OAuth2 credentials with customizable Authorization URL fields. CWE-79 (Improper Neutralization of Input During Web Page Generation - XSS) identifies the root cause: user-supplied input in the Authorization URL field is not adequately sanitized or validated before being rendered as a navigable link or href value in the DOM. This permits javascript: URI injection - a classic stored XSS technique where the browser evaluates the URI scheme as a script rather than a navigation target. Because credentials in n8n can be shared across users and workflows, the injected payload persists server-side and can be triggered by any user who interacts with the credential's authorization flow. No explicit CPE strings were provided in the available intelligence, but the vulnerability applies to all self-hosted and cloud deployments of n8n prior to version 2.8.0.
RemediationAI
The primary fix is to upgrade n8n to version 2.8.0 or later, per the vendor security advisory at https://github.com/n8n-io/n8n/security/advisories/GHSA-364x-8g5j-x2pr. For operators running the 2.6.x release branch, EUVD-2026-42257 references 2.6.4 as a patched version, though this should be confirmed against the official release notes before relying on it. If immediate upgrade is not feasible, a targeted compensating control is to restrict the 'Credentials' creation permission to trusted users only - preventing low-privilege accounts from creating or editing OAuth2 credentials eliminates the attacker's ability to inject the payload. The trade-off of this restriction is reduced self-service capability for lower-privileged users who legitimately need to configure their own integrations. Additionally, user awareness training to scrutinize OAuth2 Authorization URLs before clicking authorization buttons is a secondary but low-friction control, particularly in environments where credential sharing is common.
n8n workflow automation (through 1.121.2) allows authenticated users to execute arbitrary code via the n8n service, with
n8n workflow automation (1.65.0 to 1.121.0) allows unauthenticated file access through form-based workflows. A critical
n8n has a fifth critical RCE vulnerability (CVSS 9.9) in the Expression evaluator, enabling code execution through craft
An authenticated user with workflow creation or modification privileges in n8n workflow automation platform can exploit
Authenticated n8n users can hijack administrator accounts when LDAP authentication is enabled by manipulating their LDAP
The n8n package 0.218.0 for Node.js allows Escalation of Privileges. Rated high severity (CVSS 8.8), this vulnerability
Authenticated users can exploit string formatting and exception handling in n8n's Python task executor to escape sandbox
The n8n package 0.218.0 for Node.js allows Information Disclosure. Rated high severity (CVSS 7.5), this vulnerability is
The n8n package 0.218.0 for Node.js allows Directory Traversal. Rated medium severity (CVSS 6.5), this vulnerability is
n8n versions prior to 2.5.0 contain a critical SSH host key verification bypass in the Source Control feature that allow
This vulnerability in n8n (an open-source workflow automation platform) is an authentication bypass in the OAuth callbac
Code injection in n8n workflow automation before 2.10.1/2.9.3/1.123.22 allows authenticated users to execute arbitrary c
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today