CVE-2026-54302

n8n: Stored XSS in Chat Trigger Node

CVSS 7 HIGHEPSS 0.2%CWE-79

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 7EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

23 Jun 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, an authenticated user with workflow edit access could inject arbitrary JavaScript into the Chat Trigger's generated page by setting a malicious webhookId. When a logged-in user visited the chat URL, the injected code executed in the n8n origin with that user's session privileges. This vulnerability is fixed in 1.123.55, 2.25.7, and 2.26.2.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Affected products

n8n-io · n8n

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/n8n-io/n8n/security/advisories/GHSA-42h7-m79w-wvg5