Alex Joseph
A significant security concern has emerged for users of n8n, the popular open-source workflow automation platform. A stored Cross-Site Scripting (XSS) vulnerability, tracked as CVE-2025-61914, could allow malicious code to run within the n8n editor interface, posing a high-severity risk to system integrity and data confidentiality.
CVE Details
This vulnerability affects n8n, an open-source workflow automation platform. It was published on December 26, 2025, and is currently under “Analyzed” status. The severity level for this issue is rated as HIGH.
Affected Products
The vulnerability impacts n8n versions prior to 1.114.0. Specifically, the “Respond to Webhook” node within these earlier versions contains the flaw. After version 1.103.0, a sandbox was introduced, but this vulnerability allows scripts to escape that sandbox and execute in the main window.
Current Status
This vulnerability has been thoroughly analyzed. The good news is that a patch has been released by n8n-io to address the issue.
Severity Level
Rated as HIGH severity with a CVSS score of 7.3, this vulnerability indicates a serious risk. While it doesn’t allow direct theft of session cookies (as they are HttpOnly), a successful attack could lead to unauthorized actions within a user’s authenticated session. This includes potentially reading sensitive workflow data, altering or deleting workflows, or even injecting new malicious logic into automation flows. Such an attack could seriously compromise your automated processes and data.
Possible Solutions
The most effective solution is to update your n8n instance immediately to version 1.114.0 or later. The n8n team has released a patch that resolves this XSS vulnerability.
If immediate patching is not possible, the following workarounds can help mitigate the risk:
- Restrict Workflow Creation: Limit the ability to create and modify workflows to only trusted users. This reduces the attack surface significantly.
- Avoid Untrusted HTML: Do not use untrusted HTML content within the “Respond to Webhook” node. Always ensure that any HTML returned through this node is clean and safe.
- Implement External Filtering: Employ an external reverse proxy or an HTML sanitizer to filter out any executable scripts from responses before they reach the n8n editor interface.
References
https://github.com/n8n-io/n8n/security/advisories/GHSA-58jc-rcg5-95f3
