PT-2025-37731 · N8N · N8N+1

5H0Lm3S + 1 · Publicado 2025-09-15 · Atualizado 2025-10-14 · CVE-2025-58177

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions n8n versions 1.24.0 through 1.106.0

Description n8n is a workflow automation platform. A stored cross-site scripting (XSS) vulnerability exists in the @n8n/n8n-nodes-langchain.chatTrigger node. An authorized user can configure the LangChain Chat Trigger node with malicious JavaScript in the initialMessages field and enable public access, leading to payload execution in the browser of any user who visits the resulting public chat URL. This could be used for phishing or to steal cookies or other sensitive data from users accessing the public chat link.

Recommendations Update to version 1.107.0 or later. As a workaround, disable the @n8n/n8n-nodes-langchain.chatTrigger node.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-58177

GHSA-MVH4-2CM2-6HPG

Produtos afetados

@N8N/N8N-Nodes-Langchain.Chattrigger

N8N

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58177.json · Exploit
• https://github.com/n8n-io/n8n · Nota
• https://github.com/n8n-io/n8n/commit/d4ef191be0b39b65efa68559a3b8d5dad2e102b2 · Correção
• https://github.com/n8n-io/n8n/security/advisories/GHSA-mvh4-2cm2-6hpg · Aviso do Fabricante
• https://github.com/n8n-io/n8n/pull/18148 · Nota
• https://twitter.com/CVEnew/status/1969292019857015021 · Publicação no Twitter
• https://t.me/cveNotify/138663 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-58177 · Aviso do Fabricante
• https://docs.n8n.io/hosting/securing/blocking-nodes · Nota
• https://osv.dev/vulnerability/GHSA-mvh4-2cm2-6hpg · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-58177 · Nota de Segurança