PT-2025-33750 · N8N · N8N

Agustedone + 3 · Published 2025-08-19 · Updated 2025-08-24 · CVE-2025-52478

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: n8n versions 1.77.0 through 1.98.1

Description: n8n is a workflow automation platform. A stored Cross-Site Scripting (XSS) vulnerability exists in the Form Trigger node's HTML form element. An authenticated attacker can inject malicious HTML via an <iframe> with a srcdoc payload that includes arbitrary JavaScript execution. The attacker can also inject malicious Javascript by using <video> coupled with <source> using an onerror event. This allows for Account Takeover (ATO) by exfiltrating n8n-browserId and session cookies from authenticated users who visit a maliciously crafted form. Using these tokens and cookies, an attacker can impersonate the victim and change account details, such as email addresses, enabling full control over the account, especially if two-factor authentication is not enabled.

Recommendations: Upgrade to version 1.98.2 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-52478

GHSA-HFMV-HHH3-43F2

Affected Products

N8N

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52478.json · Exploit
• https://github.com/n8n-io/n8n/pull/16329 · Patch
• https://github.com/n8n-io/n8n/security/advisories/GHSA-hfmv-hhh3-43f2 · Vendor Advisory
• https://github.com/n8n-io/n8n/commit/7940384a85041a1890b1203d69c092c887312500 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-52478 · Security Note
• https://osv.dev/vulnerability/CVE-2025-52478 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hfmv-hhh3-43f2 · Vendor Advisory
• https://github.com/n8n-io/n8n · Note
• https://twitter.com/cracbot/status/1959571446512120079 · Twitter Post
• https://twitter.com/CVEnew/status/1957849676507697568 · Twitter Post
• https://twitter.com/CveFindCom/status/1957845132075507921 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1957905335777218697 · Twitter Post