n8n: N8n before 1.123.25 (1.x) and before 2.11.2 (2.x), with the fix also included in 2.12.0…
n8n
- Severity
- Medium, CVSS 5.4
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Record
- CVE-2026-56358
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 24, 2026
- Source last modified
- June 26, 2026
Description
n8n before 1.123.25 (1.x) and before 2.11.2 (2.x), with the fix also included in 2.12.0, contains a stored cross-site scripting vulnerability in the Form Trigger node's CSS sanitization that allows authenticated users to inject malicious scripts. Attackers with workflow creation permissions can inject XSS payloads that execute persistently for all form visitors, enabling form hijacking and phishing attacks.
Description quoted from the NVD record.