CVE-2026-56358
n8n - Stored Cross-Site Scripting in Form Trigger Node
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
n8n before 1.123.25 (1.x) and before 2.11.2 (2.x), with the fix also included in 2.12.0, contains a stored cross-site scripting vulnerability in the Form Trigger node's CSS sanitization that allows authenticated users to inject malicious scripts. Attackers with workflow creation permissions can inject XSS payloads that execute persistently for all form visitors, enabling form hijacking and phishing attacks.
| CWE | CWE-79 |
| Vendor | n8n |
| Product | n8n |
| Published | Jun 24, 2026 |
Stay Ahead of the Next One
Get instant alerts for n8n n8n
Be the first to know when new medium vulnerabilities affecting n8n n8n are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
n8n / n8n
0 < 1.123.25 2.0.0-rc.0 < 2.11.2
n8n / n8n
0 < 2.11.2
n8n / n8n
0 < 1.123.25
References
Credits
🔍 tr4ce-ju