Executive brief
n8n is a workflow automation platform that allows users to build and deploy integrations and automations. A vulnerability in the Chat Trigger node allows authenticated users with workflow edit permissions to inject malicious JavaScript code that executes with the privileges of any logged-in user who visits the generated chat URL, potentially leading to session hijacking or data theft.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the Chat Trigger node component of n8n, caused by improper sanitization of user-supplied input in the webhookId parameter. An authenticated attacker with workflow edit access can inject arbitrary JavaScript into the Chat Trigger's generated page by setting a malicious webhookId value. When a logged-in n8n user visits the chat URL, the injected script executes in the browser with that user's session privileges and access to the n8n origin, enabling session hijacking, credential theft, or manipulation of workflows. The vulnerability requires authentication and user interaction (a victim visiting the malicious chat link). Patches are available in n8n versions 1.123.55, 2.25.7, and 2.26.2 and later.
Affected products
- n8n n8n < 1.123.55, 2.0.0-rc.0 to < 2.25.7, 2.26.0 to < 2.26.2
Timeline
- 2026-06-16: disclosed: Advisory published
- 2026-06-16: patched: Fixed in versions 1.123.55, 2.25.7, and 2.26.2