PT-2026-6260 · N8N · N8N

Weblover12 · Published 2026-02-04 · Updated 2026-02-04 · CVE-2026-25051

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.2

Description n8n is a workflow automation platform. A Cross-Site Scripting (XSS) issue exists in the handling of webhook responses and related HTTP endpoints. The Content Security Policy (CSP) sandbox protection may not be applied correctly under certain conditions. An authenticated user with appropriate permissions could exploit this to execute malicious scripts with same-origin privileges when other users interact with a crafted workflow, potentially leading to session hijacking and account takeover.

Recommendations Update to version 1.123.2 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-02166

CVE-2026-25051

GHSA-825Q-W924-XHGX

Affected Products

N8N

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25051.json · Exploit
• https://github.com/n8n-io/n8n/commit/ced34c0f93ab4c759a56065965986094d8ef7323 · Patch
• https://github.com/n8n-io/n8n/commit/e8cf4d6bb3af94dc296cbb67bc3dd20e9b508ac9 · Patch
• https://github.com/n8n-io/n8n/security/advisories/GHSA-825q-w924-xhgx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25051 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-825q-w924-xhgx · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02166 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-25051 · Security Note
• https://github.com/n8n-io/n8n · Note
• https://twitter.com/CVEnew/status/2019110905280360455 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2019175471632543923 · Twitter Post