PT-2025-53603 · N8N · N8N

Nlgbao1340 · Published 2025-12-26 · Updated 2025-12-31 · CVE-2025-61914

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.114.0

Description n8n is a workflow automation platform. A stored Cross-Site Scripting (XSS) issue may occur when using the “Respond to Webhook” node in versions before 1.114.0. If this node responds with HTML content containing executable scripts, the payload may execute directly in the top-level window. This can allow a malicious actor with workflow creation permissions to execute arbitrary JavaScript in the n8n editor interface.

Recommendations Restrict workflow creation and modification privileges to trusted users only. Avoid using untrusted HTML responses in the “Respond to Webhook” node. Use an external reverse proxy or HTML sanitizer to filter responses that include executable scripts.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-61914

GHSA-58JC-RCG5-95F3

Affected Products

N8N

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61914.json · Exploit
• https://github.com/n8n-io/n8n/security/advisories/GHSA-58jc-rcg5-95f3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-61914 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61914 · Security Note
• https://t.me/CVEtracker/40728 · Telegram Post
• https://t.me/cveNotify/146919 · Telegram Post
• https://twitter.com/cracbot/status/2006319491718971433 · Twitter Post
• https://twitter.com/CVEnew/status/2004868115428216872 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2004689129141948487 · Twitter Post