Junglewise Threat Intelligence

CVE-2026-27578: n8n stored cross-site scripting in workflow nodes

CVE-2026-27578 · Severity: low · CVSS 3.1 · Published 2026-02-25

Technologies: N8n. Vendors: N8n.

Executive brief

n8n is a workflow automation platform that allows users to create and execute complex business processes. An authenticated user with workflow creation or editing permissions could inject malicious JavaScript code into certain nodes (Form Trigger, Chat Trigger, Send & Wait, Webhook, and Chat nodes). When other users access workflows containing this malicious code, the scripts execute in their browsers, allowing attackers to steal session credentials and take over accounts.

Technical details

This is a stored cross-site scripting (XSS) vulnerability affecting multiple n8n node types including Form Trigger, Chat Trigger, Send & Wait, Webhook, and Chat nodes. An authenticated user with permission to create or modify workflows can inject arbitrary JavaScript through node configurations, which is then stored in the application. The injected scripts execute in the browser context of any other user who views or interacts with the affected workflow, with user interaction required (visiting the page containing the malicious workflow). This enables session hijacking, credential theft, and account takeover. The vulnerability has been patched in versions 1.123.22, 2.9.3, and 2.10.1. Temporary mitigation involves restricting workflow creation/editing permissions and disabling the Webhook node via the NODES_EXCLUDE environment variable.

Affected products

  • n8n n8n < 1.123.22, >= 2.0.0 < 2.9.3, >= 2.10.0 < 2.10.1

Timeline

  • 2026-02-25: disclosed: Vulnerability publicly disclosed via GHSA-2p9h-rqjw-gm92
  • 2026-02-25: patched: Fixed in n8n versions 2.10.1, 2.9.3, and 1.123.22

References

Related threats