PT-2026-57175 · N8N · N8N

Tcu0N9 · Published 2026-07-10 · Updated 2026-07-10 · CVE-2026-56354

NVD

CVSS v3.1

4.1

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N

n8n before 1.123.24, 2.10.4, and 2.12.0 (across its 1.x and 2.x branches) contains cross-site scripting and open redirect vulnerabilities in the Form Node due to unsanitized HTML description fields and overly permissive iframe sandbox policies. Authenticated users with workflow creation permissions can inject malicious scripts or redirect parameters to perform stored XSS attacks or phishing redirects against end users.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-56354

Affected Products

N8N

References · 3

• https://github.com/n8n-io/n8n/security/advisories/GHSA-w673-8fjw-457c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56354 · Security Note
• https://vulncheck.com/advisories/n8n-cross-site-scripting-and-open-redirect-in-form-node · Note