n8n, a popular open-source platform for workflow automation, has addressed a security flaw that could allow malicious code to run in your browser. This vulnerability, known as reflected Cross-Site Scripting (XSS), specifically affects certain trigger nodes used for integrations with Meta (Facebook, WhatsApp) and Microsoft Teams.
In simple terms, an XSS vulnerability means that if a logged-in n8n user clicks on a specially crafted, harmful web link, an attacker could potentially inject and execute their own code within the user’s web browser. This can lead to unauthorized actions or information theft.
CVE Details
- Product Name: n8n
- Published: June 23, 2026
- Severity: Medium
- Status: Analyzed
Affected Products
This vulnerability impacts n8n versions prior to 2.24.0. If you are running any version older than 2.24.0, your instance is susceptible to this reflected XSS attack.
Current Status
The good news is that this vulnerability has been thoroughly analyzed and a fix is readily available. The n8n team has released an update that resolves the issue.
Severity Level
Rated as “Medium” severity, this reflected XSS vulnerability should not be overlooked. While it requires user interaction (a logged-in user clicking a malicious link), a successful exploit could lead to serious consequences, including unauthorized access to sensitive data within the n8n application or session hijacking. It’s crucial to patch your systems promptly to mitigate these risks.
Possible Solutions
The primary solution for this vulnerability is to upgrade your n8n instance to a patched version. Users are strongly advised to update to n8n version 2.24.0 or later as soon as possible.
If an immediate upgrade is not feasible, here are some temporary mitigation steps:
- Restrict the permissions for creating and activating workflows to only fully trusted users. This limits who can potentially introduce or exploit such vulnerabilities.
- Disable the affected trigger nodes by adding the following to your
NODES_EXCLUDEenvironment variable:n8n-nodes-base.facebookTrigger,n8n-nodes-base.whatsAppTrigger,n8n-nodes-base.facebookLeadAdsTrigger, andn8n-nodes-base.microsoftTeamsTrigger.
Please note that these workarounds are temporary and do not fully eliminate the risk. The best course of action remains a full upgrade to a patched version.
References
https://github.com/n8n-io/n8n/security/advisories/GHSA-h86q-fx34-gfjr
