CVE-2026-103249

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.80 n8n versions 2.0.0 through 2.39.5 n8n versions 2.40.0

Description A stored DOM cross-site scripting issue exists in the Resource Locator parameter dropdown link handling. Workflow authors can inject malicious script URLs into the Resource Locator parameter. This allows the execution of arbitrary JavaScript within the editor origin when another user opens the node dropdown and clicks the external-link icon. The malicious payload persists when workflows are shared or imported.

Recommendations Update to version 1.123.80 or later. Update to version 2.39.6 or later. Update to version 2.40.1 or later.