PT-2026-50169 · N8N · N8N

Sm1Ee · CVE-2026-54303 · Published 2026-06-16 · Updated 2026-07-16

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.24.0

Description An endpoint in the Meta and Microsoft Teams trigger nodes reflects a query parameter into the HTTP response without sanitization or Content-Security-Policy headers. This allows for reflected Cross-Site Scripting (XSS), where an attacker can execute malicious scripts in the n8n origin if a logged-in user visits a specially crafted URL.

Recommendations Update to version 2.24.0 or later. Limit workflow creation and activation permissions to fully trusted users only. Disable the affected nodes by adding n8n-nodes-base.facebookTrigger, n8n-nodes-base.whatsAppTrigger, n8n-nodes-base.facebookLeadAdsTrigger, and n8n-nodes-base.microsoftTeamsTrigger to the NODES EXCLUDE environment variable.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-54303

GHSA-H86Q-FX34-GFJR

Affected Products

N8N

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54303.json · Exploit
• https://github.com/n8n-io/n8n/security/advisories/GHSA-h86q-fx34-gfjr · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h86q-fx34-gfjr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-54303 · Security Note
• https://osv.dev/vulnerability/CVE-2026-54303 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-54303 · Vendor Advisory
• https://github.com/n8n-io/n8n · Note
• https://t.me/cveNotify/173304 · Telegram Post
• https://t.me/cveNotify/175930 · Telegram Post