CVE-2026-56354

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.24 n8n versions prior to 2.10.4 n8n versions prior to 2.12.0

Description The Form Node contains cross-site scripting (XSS) and open redirect issues caused by unsanitized HTML description fields and overly permissive iframe sandbox policies. Authenticated users with workflow creation permissions can inject malicious scripts or redirect parameters to execute stored XSS attacks or phishing redirects targeting end users.

Recommendations Update to version 1.123.24 or later. Update to version 2.10.4 or later. Update to version 2.12.0 or later.