CVE-2026-77072
Received Received - Intake

Stored XSS in n8n Form Node Completion Page

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: VulnCheck

Description
n8n before 1.123.69, 2.33.4, and 2.34.1 contains a stored cross-site scripting vulnerability in the Form node's completion page. The completion page applied its sandboxing Content-Security-Policy only when respondWith was not set to 'redirect', but responseText was always rendered as raw HTML. An authenticated member could set respondWith to 'redirect' via an expression while keeping responseText populated, causing the completion page to serve unsanitized HTML and script from the n8n origin. Any visitor who submitted the resulting public form would have that script execute same-origin with their session.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-77072
EUVD
EUVD-2026-63261

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
n8n n8n to 1.123.69 (exc)
n8n n8n to 2.33.4 (exc)
n8n n8n to 2.34.1 (exc)
n8n n8n 1.123.69
n8n n8n 2.33.4
n8n n8n 2.34.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in n8n versions before 1.123.69, 2.33.4, and 2.34.1. It occurs in the Form node's completion page where a sandboxing Content-Security-Policy (CSP) is bypassed when the response method is set to 'redirect' via an expression while keeping responseText populated. This causes unsanitized HTML and scripts to be rendered, allowing arbitrary script execution with the same origin as the victim's session when they submit a public form.

Detection Guidance

Check the version of n8n installed on your system. If it is prior to 1.123.69, 2.33.4, or 2.34.1, the system is vulnerable. Use commands like 'n8n --version' or inspect package.json for version details.

Impact Analysis

An attacker could exploit this to execute malicious scripts in the context of a victim's n8n session. This could lead to session hijacking, unauthorized data access, or manipulation of form submissions. Users submitting affected public forms may unknowingly run attacker-controlled scripts, compromising their data or account.

Compliance Impact

This vulnerability could lead to unauthorized data access or manipulation, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Organizations using vulnerable n8n versions may face compliance breaches, legal liabilities, and reputational damage if exploited.

Mitigation Strategies

Upgrade n8n to version 1.123.69, 2.33.4, or 2.34.1 or later immediately. If upgrading is not possible, restrict access to trusted users only or block public form endpoints at the network level as temporary measures.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77072. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart