Executive brief
n8n is a workflow automation platform used by organizations to connect and orchestrate business processes across multiple applications. An authenticated user can craft a malicious workflow that tricks the platform into serving HTML content with full JavaScript access in a victim's browser session. If a higher-privileged user opens the malicious link, an attacker could steal workflows, credentials, modify workflows, or escalate to admin access.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw in n8n's /rest/binary-data endpoint. An authenticated attacker with workflow creation/modification permissions can craft a workflow producing an HTML binary data object without a filename. The endpoint serves this content inline on the n8n origin without Content-Disposition or Content-Security-Policy headers, allowing browser-rendered HTML to execute JavaScript with full same-origin access. Attack requires authentication and user interaction (victim clicking a link), but achieves confidentiality and integrity compromise through credential/workflow exfiltration and privilege escalation. Patches are available in versions 1.123.27, 2.13.3, and 2.14.1.
Affected products
- n8n n8n versions prior to 1.123.27, 2.0.0-rc.0 to 2.13.2, and 2.14.0
Timeline
- 2026-03-25: disclosed
- 2026-03-26: patched: Patches released in versions 1.123.27, 2.13.3, and 2.14.1