PT-2026-57175

CVE-2026-56354

Published

2026-03-27

Updated

2026-07-10

Description by

CVSS 3.1

5.4

Medium

MetricsAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.24 n8n versions prior to 2.10.4 n8n versions prior to 2.12.0

Description The Form Node contains cross-site scripting (XSS) and open redirect issues caused by unsanitized HTML description fields and overly permissive iframe sandbox policies. Authenticated users with workflow creation permissions can inject malicious scripts or redirect parameters to execute stored XSS attacks or phishing redirects targeting end users.

Recommendations Update to version 1.123.24 or later. Update to version 2.10.4 or later. Update to version 2.12.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Tcu0N9

Vendors

Affected products

Weakness enumeration

CWE-601: URL Redirection to Untrusted Site (\'Open Redirect\')

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')