| Component | n8n |
| Severity | high (CVSS 7.3) |
| CVSS vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N |
| Published (NVD) | 2026-10-28 |
| Affected versions | < 1.123.85 < 2.43.5 >= 2.44.0, < 2.44.1 read from the advisory text, followed where the structured sources say otherwise |
| Fixed in | 2.43.5, 2.44.1 |
| Weakness | CWE-79 |
| CISA KEV | not listed |
Versions, checked against NVD
NVD's record (status: Deferred) lists no affected versions of n8n for this CVE. The ranges above are read from the advisory text: neither a GitHub-reviewed advisory nor the CVE record confirms them yet.
NVD description
n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a stored cross-site scripting vulnerability because some webhook response paths, such as error responses and responses without headers, omit the sandbox Content-Security-Policy. Authenticated members who can create and activate workflows can serve HTML that runs on the n8n origin, letting scripts act with the session of users who open the webhook URL.
What to do
- Upgrade n8n to the fixed release of the branch you run:
2.43.5or2.44.1, or later. - Do not expose the component's API or UI to the internet without authentication in front of it.
Sources
- NVD: CVE-2026-118648
- https://github.com/n8n-io/n8n/security/advisories/GHSA-mp7q-23hg-35cf
- https://www.vulncheck.com/advisories/n8n-before-1.123.85-2.43.5-and-2.44.1-stored-xss-via-webhook-responses-missing-sandbox-policy