CVE-2026-56358
Full vulnerability record from the local CVENow database.
Description
n8n before 1.123.25 (1.x) and before 2.11.2 (2.x), with the fix also included in 2.12.0, contains a stored cross-site scripting vulnerability in the Form Trigger node's CSS sanitization that allows authenticated users to inject malicious scripts. Attackers with workflow creation permissions can inject XSS payloads that execute persistently for all form visitors, enabling form hijacking and phishing attacks.
Severity
MEDIUM
CVSS score
5.1
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-06-24 13:16:36.613000
Last modified
2026-10-29 19:17:22.690000
View original CVE JSON
{
"id": "CVE-2026-56358",
"sourceIdentifier": "[email protected]",
"published": "2026-06-24T13:16:36.613",
"lastModified": "2026-10-29T19:17:22.690",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "n8n before 1.123.25 (1.x) and before 2.11.2 (2.x), with the fix also included in 2.12.0, contains a stored cross-site scripting vulnerability in the Form Trigger node's CSS sanitization that allows authenticated users to inject malicious scripts. Attackers with workflow creation permissions can inject XSS payloads that execute persistently for all form visitors, enabling form hijacking and phishing attacks."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "n8n",
"product": "n8n",
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/n8n",
"versions": [
{
"version": "0",
"lessThan": "1.123.25",
"versionType": "semver",
"status": "affected"
},
{
"version": "1.123.25",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "2.0.0-rc.0",
"lessThan": "2.11.2",
"versionType": "semver",
"status": "affected"
},
{
"version": "2.11.2",
"versionType": "semver",
"status": "unaffected"
}
]
},
{
"vendor": "n8n",
"product": "n8n",
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/n8n",
"versions": [
{
"version": "2.0.0-rc.0",
"lessThan": "2.11.2",
"versionType": "semver",
"status": "affected"
},
{
"version": "2.11.2",
"versionType": "semver",
"status": "unaffected"
}
]
},
{
"vendor": "n8n",
"product": "n8n",
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/n8n",
"versions": [
{
"version": "0",
"lessThan": "1.123.25",
"versionType": "semver",
"status": "affected"
},
{
"version": "1.123.25",
"versionType": "semver",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-06-24T16:01:36.636711Z",
"id": "CVE-2026-56358",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*",
"versionEndExcluding": "1.123.25",
"matchCriteriaId": "3531A0AA-A14C-4B12-9DF5-FDD18045DE34"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*",
"versionStartIncluding": "2.0.0",
"versionEndExcluding": "2.11.2",
"matchCriteriaId": "6A4BD033-FBE2-4007-B51F-E011D553C6C8"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-q4fm-pjq6-m63g",
"source": "[email protected]",
"tags": [
"Mitigation",
"Vendor Advisory"
]
},
{
"url": "https://www.vulncheck.com/advisories/n8n-stored-cross-site-scripting-in-form-trigger-node",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
}
]
}