MSRXMSRXSecurity
Vulnerabilities / CVE-2026-118648

CVE-2026-118648

Published 2026-10-28 · Deferred

CVE-2026-118648

n8n before 1.123.85, 2.43.5, and 2.44.1 Stored XSS via Webhook Responses Missing Sandbox Policy

8.4 HIGH
CVSS 4.0 · CNA · vulncheck.com
0.3%
chance of exploitation in the next 30 days (EPSS; higher than 17% of CVEs)

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a stored cross-site scripting vulnerability because some webhook response paths, such as error responses and responses without headers, omit the sandbox Content-Security-Policy. Authenticated members who can create and activate workflows can serve HTML that runs on the n8n origin, letting scripts act with the session of users who open the webhook URL.

Scores

8.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:NCNA · vulncheck.com
7.3CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:NCNA · vulncheck.com

Affected products

  • n8n-io n8n: < 1.123.85
  • n8n-io n8n: 2.44.0 to < 2.44.1
  • n8n-io n8n: 2.0.0 to < 2.43.5

Weakness: CWE-79

Also known as: GHSA-mp7q-23hg-35cf

2 references (advisories, patches, write-ups)

Sources: NVD, CVE.org, OSV.dev, FIRST EPSS. Missing ones did not answer or have no record yet.

Look up another CVECheck your dependenciesScan a website