PT-2026-114161 · Git+1 · N8N
CVE-2026-110847
·
Published
2026-10-14
·
Updated
2026-10-14
CVSS v4.0
7.0
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
n8n versions prior to 1.123.83
n8n versions 2.x prior to 2.41.4
n8n versions 2.42.x prior to 2.42.1
Description
A stored cross-site scripting issue exists in the Chat Trigger hosted-chat page. The problem occurs because
customCss values are not sufficiently sanitized before being interpolated into the page as markup. This allows workflow authors to publish a chat that does not require n8n user authentication, enabling a payload to execute on the instance origin and act on the sessions of signed-in visitors.Recommendations
Update to version 1.123.83 or later.
Update to version 2.41.4 or later for the 2.x branch.
Update to version 2.42.1 or later for the 2.42.x branch.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
N8N