Stored Cross-Site Scripting Vulnerability in n8n Form Node

CVE-2026-77072

What is CVE-2026-77072?

n8n versions before 1.123.69, 2.33.4, and 2.34.1 are susceptible to a stored cross-site scripting (XSS) vulnerability in the Form node's completion page. This issue arises when the Content-Security-Policy's sandboxing is applied only under specific conditions, while the responseText is rendered as raw HTML. Authenticated users can exploit this by setting respondWith to 'redirect' through an expression, leaving responseText unfiltered. As a result, any public form submissions may execute unsanitized HTML or scripts, compromising user sessions and web application security.

References