CVE-2026-56356
n8n - Stored Cross-Site Scripting in Chat Trigger Node Custom CSS Field
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
n8n contains a stored cross-site scripting vulnerability in the Chat Trigger node's Custom CSS field due to a misconfiguration of the sanitize-html library. Affected releases are those before 1.123.27, the 2.0.0 through 2.13.2 line, and 2.14.0 (fixed in 1.123.27, 2.13.3, and 2.14.1). An authenticated user with permission to create or modify workflows can inject JavaScript that bypasses sanitization, resulting in stored XSS against any user who visits the public chat page.
| CWE | CWE-79 |
| Vendor | n8n |
| Product | n8n |
| Published | Jun 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for n8n n8n
Be the first to know when new medium vulnerabilities affecting n8n n8n are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
n8n / n8n
0 < 1.123.27 2.0.0-rc.0 < 2.13.3 2.14.0 < 2.14.1
n8n / n8n
0 < 2.14.1
n8n / n8n
0 < 2.13.3
References
Credits
🔍 JorianWoltjer