n8n: N8n before 1.123.69, 2.33.4, and 2.34.1 contains a stored cross-site scripting vulnerability in…
n8n
- Severity
- High, CVSS 7.6
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
- Record
- CVE-2026-77072
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- August 20, 2026
- Source last modified
- September 1, 2026
Description
n8n before 1.123.69, 2.33.4, and 2.34.1 contains a stored cross-site scripting vulnerability in the Form node's completion page. The completion page applied its sandboxing Content-Security-Policy only when respondWith was not set to 'redirect', but responseText was always rendered as raw HTML. An authenticated member could set respondWith to 'redirect' via an expression while keeping responseText populated, causing the completion page to serve unsanitized HTML and script from the n8n origin. Any visitor who submitted the resulting public form would have that script execute same-origin with their session.
Description quoted from the NVD record.
Who is affected
n8n, a tool for automating tasks by connecting apps and services into workflows, has a problem in the page people see after they submit a form built with its form feature. This flaw affects versions before 1.123.69, 2.33.4, and 2.34.1. A person with a member account on your n8n could set up a public form so that its completion page carries harmful code. Anyone who then submits that form would have that code run in their web browser as if it came from your n8n site, using their own logged-in session. This flaw is rated High.
What to do
- If someone in your organization installed and runs n8n, that person should make the update below.
- If an IT provider or vendor runs n8n for you, send them this advisory and ask when the update will be done.
- Update n8n to the fixed version for the release you use:
1.123.69,2.33.4, or2.34.1, or any later version. - No workaround is named for this flaw, so plan the update soon and check the vendor advisory linked on this page for details on the fixed releases.
Analysis written from the source record as of September 1, 2026 and reviewed before publishing.