CVE-2026-56358
CVE-2026-56358 · n8n - Stored Cross-Site Scripting in Form Trigger Node
This page contains facts from public vulnerability sources. Check the original advisory before updating.
n8n before 1.123.25 (1.x) and before 2.11.2 (2.x), with the fix also included in 2.12.0, contains a stored cross-site scripting vulnerability in the Form Trigger node's CSS sanitization that allows authenticated users to inject malicious scripts. Attackers with workflow creation permissions can inject XSS payloads that execute persistently for all form visitors, enabling form hijacking and phishing attacks.
CVSS 5.1 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
n8n
- Versions
- ≥ 0, < 1.123.25: Affected (semver)
- 1.123.25: Not affected (semver)
- ≥ 2.0.0-rc.0, < 2.11.2: Affected (semver)
- 2.11.2: Not affected (semver)
Update to 1.123.25; Update to 2.11.2
n8n
- Versions
- ≥ 0, < 2.11.2: Affected (semver)
- 2.11.2: Not affected (semver)
Update to 2.11.2
n8n
- Versions
- ≥ 0, < 1.123.25: Affected (semver)
- 1.123.25: Not affected (semver)
Update to 1.123.25
n8n npm
- Affected ranges
- SEMVER: ≥ 2.0.0-rc.0, < 2.11.2
Update to 2.11.2
n8n npm
- Affected ranges
- SEMVER: < 1.123.25
Update to 1.123.25