CVE-2026-118648

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.85 n8n versions prior to 2.43.5 n8n versions prior to 2.44.1

Description A stored cross-site scripting issue exists because certain webhook response paths, including error responses and responses lacking headers, do not implement the sandbox Content-Security-Policy (a security layer that helps detect and mitigate certain types of attacks, including XSS). Authenticated members with permissions to create and activate workflows can deliver HTML that executes on the n8n origin, allowing scripts to operate using the session of any user who accesses the webhook URL.

Recommendations Update to version 1.123.85 or later. Update to version 2.43.5 or later. Update to version 2.44.1 or later.