EUVD-2026-40444
GHSA-99wx-hwrx-8g4w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stored XSS exploitable over network by authenticated workflow editor (PR:L), requires victim page visit (UI:R), scope change (S:C) reflects cross-user impact; no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
n8n contains a stored cross-site scripting vulnerability in the Chat Trigger node's Custom CSS field due to a misconfiguration of the sanitize-html library. Affected releases are those before 1.123.27, the 2.0.0 through 2.13.2 line, and 2.14.0 (fixed in 1.123.27, 2.13.3, and 2.14.1). An authenticated user with permission to create or modify workflows can inject JavaScript that bypasses sanitization, resulting in stored XSS against any user who visits the public chat page.
AnalysisAI
Stored XSS in n8n's Chat Trigger node allows authenticated workflow editors to inject JavaScript through a misconfigured sanitize-html filter in the Custom CSS field, which then executes in the browsers of every user visiting the public chat page. Affected are all 1.x releases before 1.123.27, the 2.0.0-2.13.2 range, and 2.14.0; fixed versions are 1.123.27, 2.13.3, and 2.14.1. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS 4.0 score of 5.1 reflects the authenticated prerequisite and bounded per-user impact.
Technical ContextAI
n8n is an open-source workflow automation platform (CPE: cpe:2.3:a:n8n:n8n) whose Chat Trigger node exposes a publicly accessible chat interface, configurable with a Custom CSS field. n8n uses the sanitize-html JavaScript library to strip dangerous markup before rendering user-supplied content, but a misconfiguration in how the library is applied to this specific field allows crafted input to bypass filtering. CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting) is the root cause: the application stores unsanitized attacker-controlled data server-side and later renders it verbatim into the chat page DOM, making this a persistent (stored) variant. Because the public chat page is served to all visitors without authentication, a single injection poisons the page for every subsequent user, amplifying impact beyond the injecting account.
RemediationAI
Upgrade n8n to version 1.123.27 (for the 1.x line), 2.13.3 (for the 2.13.x line), or 2.14.1 (for the 2.14.x line) as documented in the vendor advisory at https://github.com/n8n-io/n8n/security/advisories/GHSA-3c7f-5hgj-h279. If immediate patching is not feasible, restrict workflow creation and modification permissions to only fully trusted personnel, since the attack requires an authenticated account with those privileges - revoking or auditing who holds such rights limits the injection surface. Additionally, consider disabling or blocking public access to Chat Trigger node endpoints until the patch is applied; this eliminates victim exposure at the cost of interrupting any public-facing chat workflows. There are no other documented workarounds that address the sanitize-html misconfiguration directly without a code-level fix.
n8n workflow automation (through 1.121.2) allows authenticated users to execute arbitrary code via the n8n service, with
n8n workflow automation (1.65.0 to 1.121.0) allows unauthenticated file access through form-based workflows. A critical
n8n has a fifth critical RCE vulnerability (CVSS 9.9) in the Expression evaluator, enabling code execution through craft
A prototype pollution vulnerability in the XML and GSuiteAdmin nodes of n8n workflow automation platform allows authenti
An authenticated user with workflow creation or modification privileges in n8n workflow automation platform can exploit
n8n-workflows Main Commit ee25413 allows attackers to execute a directory traversal via the download_workflow function w
Authenticated n8n users can hijack administrator accounts when LDAP authentication is enabled by manipulating their LDAP
The n8n package 0.218.0 for Node.js allows Escalation of Privileges. Rated high severity (CVSS 8.8), this vulnerability
SQL injection in n8n's Data Table Get node allows authenticated users with workflow modification permissions to execute
Authenticated users can exploit string formatting and exception handling in n8n's Python task executor to escape sandbox
n8n workflow automation platform Community Edition contains an authorization bypass vulnerability allowing authenticated
The n8n package 0.218.0 for Node.js allows Information Disclosure. Rated high severity (CVSS 7.5), this vulnerability is
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today