CVEvulnerability

CVE-2026-56354

5.1 MEDIUM Published 2026-07-10 Modified 2026-07-13 Official page ↗
Status
Analyzed
Published
2026-07-10
Last modified
2026-07-13
Assigner
[email protected]
CVSS 4.0 ([email protected])
5.1 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
4.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
CVSS 3.1 ([email protected])
5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79

Description

n8n before 1.123.24, 2.10.4, and 2.12.0 (across its 1.x and 2.x branches) contains cross-site scripting and open redirect vulnerabilities in the Form Node due to unsanitized HTML description fields and overly permissive iframe sandbox policies. Authenticated users with workflow creation permissions can inject malicious scripts or redirect parameters to perform stored XSS attacks or phishing redirects against end users.

Affected configurations

• n8n n8n (< 1.123.24) • n8n n8n (>= 2.0.0 < 2.10.4) • n8n n8n (>= 2.10.0 < 2.10.4) • n8n n8n (>= 2.11.0 < 2.12.0)

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References