Executive brief
n8n is a workflow automation platform that allows users to create and execute automated processes. A vulnerability in how n8n handles webhook responses can allow authenticated users with workflow creation permissions to inject malicious scripts that execute with the same privileges as other users viewing the workflow, potentially leading to session hijacking and account takeover.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in n8n's webhook response handling and related HTTP endpoints where Content Security Policy (CSP) sandbox protection fails to be applied correctly under certain conditions. The vulnerability is triggered when authenticated users with workflow creation or modification permissions craft malicious workflows that execute JavaScript with same-origin privileges when other users interact with them. The attack requires authentication and user interaction but can result in full account compromise. The issue is fixed in n8n versions 1.122.5 and 1.123.2.
Affected products
- n8n n8n All versions before 1.122.5; 1.123.0 before 1.123.2
Timeline
- 2026-02-04: disclosed: Advisory published
- 2026-02-04: patched: Fixed in versions 1.122.5 and 1.123.2