PT-2025-37731 · N8N · @N8N/N8N-Nodes-Langchain.Chattrigger+1

5H0Lm3S + 1 · Published 2025-09-15 · Updated 2025-10-14 · CVE-2025-58177

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions n8n versions 1.24.0 through 1.106.0

Description n8n is a workflow automation platform. A stored cross-site scripting (XSS) vulnerability exists in the @n8n/n8n-nodes-langchain.chatTrigger node. An authorized user can configure the LangChain Chat Trigger node with malicious JavaScript in the initialMessages field and enable public access, leading to payload execution in the browser of any user who visits the resulting public chat URL. This could be used for phishing or to steal cookies or other sensitive data from users accessing the public chat link.

Recommendations Update to version 1.107.0 or later. As a workaround, disable the @n8n/n8n-nodes-langchain.chatTrigger node.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-58177

GHSA-MVH4-2CM2-6HPG

Affected Products

@N8N/N8N-Nodes-Langchain.Chattrigger

N8N

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58177.json · Exploit
• https://github.com/n8n-io/n8n/commit/d4ef191be0b39b65efa68559a3b8d5dad2e102b2 · Patch
• https://github.com/n8n-io/n8n/security/advisories/GHSA-mvh4-2cm2-6hpg · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mvh4-2cm2-6hpg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58177 · Security Note
• https://osv.dev/vulnerability/CVE-2025-58177 · Vendor Advisory
• https://github.com/n8n-io/n8n · Note
• https://github.com/n8n-io/n8n/pull/18148 · Note
• https://docs.n8n.io/hosting/securing/blocking-nodes · Note
• https://twitter.com/CVEnew/status/1969292019857015021 · Twitter Post
• https://t.me/cveNotify/138663 · Telegram Post