JavaScript Injection in n8n Workflow Automation

Executive Summary

CVE-2026-54302 is a stored cross-site scripting (XSS) vulnerability in the n8n workflow automation platform. It affects versions prior to 1.123.55, 2.25.7, and 2.26.2. An authenticated user with workflow edit permissions can inject malicious JavaScript code into the Chat Trigger node's webhookId parameter. When another logged-in user visits the chat URL, the injected code executes within the n8n origin using that user's session privileges.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized execution of malicious JavaScript code within the context of a logged-in user's session. This can compromise the confidentiality and integrity of user data by allowing attackers to hijack sessions, steal sensitive information, or perform actions on behalf of the user. The vulnerability has a high severity rating (CVSS 7.0) due to these potential impacts.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, you should upgrade n8n to one of the patched versions: 1.123.55, 2.25.7, or 2.26.2.

If upgrading is not immediately possible, apply temporary mitigations such as restricting workflow editing permissions to trusted users or disabling the Chat Trigger node to prevent exploitation.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an authenticated user with workflow edit access to inject arbitrary JavaScript that executes with the privileges of a logged-in user, potentially compromising confidentiality and integrity of user sessions.

Such a compromise could lead to unauthorized access or exposure of sensitive data, which may impact compliance with standards and regulations like GDPR and HIPAA that require protection of personal and sensitive information.

Remediation by upgrading to fixed versions or applying mitigations is necessary to maintain compliance and reduce risk.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves an authenticated user injecting malicious JavaScript into the Chat Trigger node's webhookId parameter in n8n versions prior to 1.123.55, 2.25.7, and 2.26.2.

Detection would typically require checking if your n8n instance is running a vulnerable version and if any workflows have been edited by users with workflow edit permissions to include suspicious or unexpected JavaScript code in the webhookId field.

Since the vulnerability is triggered when a logged-in user visits the chat URL, monitoring HTTP requests to the chat URL for unusual parameters or payloads could help detect exploitation attempts.

No specific detection commands or scripts are provided in the available resources.

Useful 0 Not Useful 0