Executive brief
n8n is a workflow automation platform that allows users to create and manage automated processes. An authenticated user can inject malicious code into forms through HTML elements, which executes when other users view the form, allowing attackers to steal session credentials and take over victim accounts, including changing email addresses and gaining full administrative control.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in n8n's Form Trigger node, specifically in the HTML form element component. An authenticated attacker can inject malicious JavaScript via iframe srcdoc attributes or video/source tags with onerror event handlers. The vulnerability requires user interaction (a victim visiting the maliciously crafted form) but allows attackers to exfiltrate n8n-browserId and session cookies. Using these stolen credentials, an attacker can impersonate the victim and modify account settings such as email addresses, achieving full account takeover. The issue was fixed in version 1.98.2 (PR #16329); affected versions are 1.77.0 through 1.98.1.
Affected products
- n8n n8n >=1.77.0, <1.98.2
Timeline
- 2025-08-19: disclosed: Advisory published
- 2025-08-19: patched: Version 1.98.2 released with fix