PT-2026-103782

CVE-2026-103249

Published

2026-10-01

Updated

2026-10-01

Description by

CVSS 3.1

7.6

High

MetricsAV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.80 n8n versions 2.0.0 through 2.39.5 n8n versions 2.40.0

Description A stored DOM cross-site scripting issue exists in the Resource Locator parameter dropdown link handling. Workflow authors can inject malicious script URLs into the Resource Locator parameter. This allows the execution of arbitrary JavaScript within the editor origin when another user opens the node dropdown and clicks the external-link icon. The malicious payload persists when workflows are shared or imported.

Recommendations Update to version 1.123.80 or later. Update to version 2.39.6 or later. Update to version 2.40.1 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Tr4Ce-Ju

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers