CVE-2026-42235
Stored XSS in n8n Workflow Automation Platform
Publication date: 2026-05-04
Last updated on: 2026-05-06
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| n8n | n8n | to 1.123.32 (exc) |
| n8n | n8n | 2.18.0 |
| n8n | n8n | From 2.17.0 (inc) to 2.17.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-87 | The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects the n8n workflow automation platform prior to versions 1.123.32, 2.17.4, and 2.18.1. An unauthenticated attacker could register a malicious OAuth client with a specially crafted client_name. If a victim user authorized the OAuth consent dialog and then a second user revoked that access, a toast notification would render the injected script. Clicking the link in this notification would execute arbitrary JavaScript in the victim's authenticated n8n browser session.
This allows the attacker to steal credentials and session tokens, manipulate workflows, or escalate privileges within the n8n platform.
How can this vulnerability impact me? :
The vulnerability can lead to serious security impacts including theft of user credentials and session tokens, unauthorized manipulation of workflows, and privilege escalation within the n8n platform.
An attacker exploiting this vulnerability could gain unauthorized access to sensitive data and perform actions on behalf of the victim user, potentially compromising the integrity and confidentiality of automated workflows.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade your n8n installation to one of the patched versions: 1.123.32, 2.17.4, or 2.18.1.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows an unauthenticated attacker to execute arbitrary JavaScript in a victim's authenticated n8n browser session, potentially leading to credential and session token theft, workflow manipulation, or privilege escalation.
Such unauthorized access and data theft could lead to violations of data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access and breaches.
Therefore, if exploited, this vulnerability could compromise compliance with these standards by exposing sensitive user data and undermining system integrity.