Cross-site scripting in n8n - CVE-2026-118648
Published: October 14, 2026 / Updated: November 2, 2026
Vulnerability identifier: #VU155729
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-118648
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary scripts on the n8n origin using another user's session.
The vulnerability exists due to failure to apply the sandbox content security policy in webhook response handling when returning error responses or certain responses without headers. A remote user can serve workflow-generated HTML containing malicious scripts through a webhook URL to execute arbitrary scripts on the n8n origin using another user's session.
Exploitation requires permission to create and activate workflows and another user to open the webhook URL.
Affected software
n8n
How to mitigate CVE-2026-118648
Install security update from vendor's website.
n8n - addressed in versions 1.123.85, 2.43.5, 2.44.1