Stored Cross-Site Scripting in n8n by n8n-io

CVE-2026-118648

What is CVE-2026-118648?

The n8n platform, versions before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1, is vulnerable to a stored cross-site scripting (XSS) attack. This vulnerability arises from certain webhook response paths that return error messages or lack headers and consequently omit the sandbox Content-Security-Policy. Authenticated users with permissions to create and activate workflows can exploit this flaw by serving HTML content that executes on the n8n origin, resulting in scripts running within the context of users' sessions when they access the malicious webhook URL.

References