CVE-2026-56356
CVE-2026-56356 · n8n - Stored Cross-Site Scripting in Chat Trigger Node Custom CSS Field
This page contains facts from public vulnerability sources. Check the original advisory before updating.
n8n contains a stored cross-site scripting vulnerability in the Chat Trigger node's Custom CSS field due to a misconfiguration of the sanitize-html library. Affected releases are those before 1.123.27, the 2.0.0 through 2.13.2 line, and 2.14.0 (fixed in 1.123.27, 2.13.3, and 2.14.1). An authenticated user with permission to create or modify workflows can inject JavaScript that bypasses sanitization, resulting in stored XSS against any user who visits the public chat page.
CVSS 5.1 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
n8n
- Versions
- ≥ 0, < 1.123.27: Affected (semver)
- 1.123.27: Not affected (semver)
- ≥ 2.0.0-rc.0, < 2.13.3: Affected (semver)
- 2.13.3: Not affected (semver)
- ≥ 2.14.0, < 2.14.1: Affected (semver)
- 2.14.1: Not affected (semver)
Update to 1.123.27; Update to 2.13.3; Update to 2.14.1
n8n
- Versions
- ≥ 0, < 2.14.1: Affected (semver)
- 2.14.1: Not affected (semver)
Update to 2.14.1
n8n
- Versions
- ≥ 0, < 2.13.3: Affected (semver)
- 2.13.3: Not affected (semver)
Update to 2.13.3
n8n npm
- Affected ranges
- SEMVER: < 1.123.27
Update to 1.123.27
n8n npm
- Versions
- 2.14.0
- Affected ranges
- SEMVER: ≥ 2.14.0, < 2.14.1
Update to 2.14.1
n8n npm
- Affected ranges
- SEMVER: ≥ 2.0.0-rc.0, < 2.13.3
Update to 2.13.3