Executive brief
n8n is a workflow automation tool used to connect different business applications. A security flaw in its Meta (Facebook/WhatsApp) and Microsoft Teams integration components allows an attacker to execute malicious scripts in a user's browser if they are tricked into clicking a specific link. This could lead to unauthorized access to sensitive information or the hijacking of a logged-in user's session.
Technical details
A reflected Cross-Site Scripting (XSS) vulnerability exists in n8n's webhook verification endpoints for Meta (Facebook, WhatsApp, Lead Ads) and Microsoft Teams trigger nodes. The root cause is the lack of input sanitization and missing Content-Security-Policy (CSP) headers, which allows query parameters to be reflected directly into the HTTP response. An attacker with low privileges can exploit this by crafting a malicious URL and tricking a logged-in user into visiting it. Successful exploitation allows the execution of arbitrary JavaScript in the context of the n8n application, potentially leading to sensitive data disclosure. The issue is resolved in version 2.24.0.
Affected products
- n8n-io n8n < 2.24.0
Timeline
- 2026-06-10: advisory: GitHub advisory published by vendor
- 2026-06-23: disclosed: CVE published to NVD