CVE-2026-110849

Deferred Deferred - Pending Action

Stored XSS in n8n File Preview Modal

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary data as an unsandboxed same-origin blob URL. A member who uploads a crafted item can run script in the n8n origin of whoever previews it, typically the owner, and act with their session.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110849

EUVD

EUVD-2026-101732

Affected Vendors & Products

Vendor	Product	Version / Range
n8n-io	n8n	0
n8n-io	n8n	2.0.0
n8n-io	n8n	2.42.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

n8n before versions 1.123.83, 2.41.4, and 2.42.1 has a stored cross-site scripting (XSS) vulnerability in the file-preview modal. When a user uploads a crafted file, it re-publishes binary data as an unsandboxed same-origin blob URL. This allows the uploaded file to execute scripts in the n8n origin when previewed by another user, typically the owner, potentially compromising their session.

Detection Guidance

This vulnerability involves a stored XSS in n8n's file-preview modal. To detect it, check for unusual script execution in n8n's interface or logs when previewing files. Review uploaded files for malicious payloads and monitor network traffic for unexpected requests originating from n8n.

Impact Analysis

This vulnerability allows an attacker to run malicious scripts in the context of your n8n session if you preview a crafted file. This could lead to session hijacking, unauthorized actions on your behalf, or data theft. Users who upload or preview files in affected n8n versions are at risk.

Compliance Impact

This XSS vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations using affected n8n versions may face compliance risks if exploited.

Mitigation Strategies

Immediately upgrade n8n to version 1.123.83, 2.41.4, or 2.42.1 or later to address the stored cross-site scripting vulnerability in the file-preview modal.

Hi! I’m here to help you understand CVE-2026-110849. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70