Understanding the n8n Cross-Site Scripting Vulnerability
n8n is a popular open-source platform that helps you automate workflows and connect various applications. However, a recently discovered security flaw, identified as CVE-2026-54302, could allow malicious code to be injected into its system. This vulnerability affects certain versions of n8n and highlights the importance of keeping your software updated.
In simple terms, an authenticated user who had permission to edit workflows could sneak harmful JavaScript code into a special page created by n8n’s “Chat Trigger.” If another logged-in user then visited this chat page, the hidden malicious code would run in their browser. This could potentially give the attacker access to that user’s session and their privileges within n8n.
CVE Details
- Product: n8n
- Published Date: June 23, 2026
- Severity: MEDIUM (CVSS 3.1 score: 5.4)
- Status: Analyzed
Affected Products
The vulnerability impacts n8n versions prior to the following patches:
- All versions before 1.123.55
- All versions before 2.25.7
- All versions before 2.26.2
Users running any n8n version older than those listed should update immediately to protect their systems.
Current Status
This vulnerability has been thoroughly analyzed. Thankfully, n8n developers have already released fixes, and updated versions are available. This means that users can take action to secure their installations by applying the recommended patches.
Severity Level
The CVE-2026-54302 vulnerability is rated as MEDIUM severity with a CVSS 3.1 score of 5.4. While classified as medium, it’s important to understand the potential risks. Cross-Site Scripting (XSS) vulnerabilities like this one can be used to steal session cookies, deface websites, or redirect users to malicious sites, all within the context of the user’s current session. The GitHub advisory for this vulnerability also assigns a High severity with a CVSS 4.0 base score of 7.0, as n8n has adopted CVSS 4.0 for its advisories. This higher score reflects an updated assessment of the overall impact, emphasizing the need for prompt action.
Possible Solutions
The most effective way to protect your n8n installation from CVE-2026-54302 is to upgrade to a patched version. The following versions contain the necessary fixes:
- n8n 1.123.55 or later
- n8n 2.25.7 or later
- n8n 2.26.2 or later
Temporary Workarounds:
If an immediate upgrade is not feasible, you can implement temporary mitigation steps:
- Limit Workflow Permissions: Ensure that only highly trusted users have the ability to create or edit workflows. This reduces the attack surface by restricting who can potentially introduce malicious `webhookId` values.
- Disable Chat Trigger Node: You can disable the vulnerable Chat Trigger node entirely. To do this, add `@n8n/n8n-nodes-langchain.chatTrigger` to your `NODES_EXCLUDE` environment variable.
Please note that these workarounds are temporary and do not fully eliminate the risk. A full update to a patched version is strongly recommended as soon as possible.
References
https://github.com/n8n-io/n8n/security/advisories/GHSA-42h7-m79w-wvg5
