CVE-2026-56358

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.25 n8n versions prior to 2.11.2

Description An authenticated user with permissions to create or modify workflows can exploit a flaw in the CSS sanitization of the Form Trigger node to store a cross-site scripting (XSS) payload. XSS is a type of security issue where malicious scripts are injected into trusted websites. The injected script executes persistently for every visitor of the published form, which enables phishing and the hijacking of form submissions. While the Content Security Policy prevents the theft of n8n session cookies, it does not stop script execution or the manipulation of form actions.

Recommendations Update to version 1.123.25 or later. Update to version 2.11.2 or later. Limit workflow creation and editing permissions to fully trusted users only. Disable the Form Trigger node by adding n8n-nodes-base.formTrigger to the NODES EXCLUDE environment variable.