Executive brief
n8n is a popular workflow automation and integration platform. The Form node allows building interactive forms within workflows; the completion page that displays after form submission contained a stored cross-site scripting vulnerability. An authenticated user could craft a malicious form that executes JavaScript in the browser of anyone submitting that form, potentially stealing session cookies, form data, or performing unauthorized actions on behalf of the victim.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the n8n Form node's completion page. The root cause lies in a logic error: the Content-Security-Policy sandboxing was only applied when the "respondWith" parameter was not set to "redirect", but the "responseText" field was always rendered as raw HTML regardless. An authenticated member could bypass the sandbox by setting respondWith to "redirect" via an expression while populating responseText with malicious HTML and JavaScript, causing the completion page to serve unescaped content from the n8n origin. When a visitor submitted the resulting public form, the injected script would execute with the same origin as the n8n application, giving it access to session cookies and sensitive data. The vulnerability requires authentication to create the malicious form but affects any unauthenticated user who subsequently submits it.
Affected products
- n8n n8n before 1.123.69, 2.33.4, and 2.34.1
Timeline
- 2026-08-20: disclosed
- 2026-08-05: advisory: GitHub Security Advisory GHSA-rmr5-775f-jvm2 published