CVE-2026-25051

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25051", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-28T14:50:47.888Z", "datePublished": "2026-02-04T16:46:53.285Z", "dateUpdated": "2026-02-05T14:36:06.937Z"}, "containers": {"cna": {"title": "n8n Improper CSP Enforcement in Webhook Responses May Allow Stored XSS", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/n8n-io/n8n/security/advisories/GHSA-825q-w924-xhgx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-825q-w924-xhgx"}, {"name": "https://github.com/n8n-io/n8n/commit/ced34c0f93ab4c759a56065965986094d8ef7323", "tags": ["x_refsource_MISC"], "url": "https://github.com/n8n-io/n8n/commit/ced34c0f93ab4c759a56065965986094d8ef7323"}, {"name": "https://github.com/n8n-io/n8n/commit/e8cf4d6bb3af94dc296cbb67bc3dd20e9b508ac9", "tags": ["x_refsource_MISC"], "url": "https://github.com/n8n-io/n8n/commit/e8cf4d6bb3af94dc296cbb67bc3dd20e9b508ac9"}], "affected": [{"vendor": "n8n-io", "product": "n8n", "versions": [{"version": "< 1.123.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-04T16:46:53.285Z"}, "descriptions": [{"lang": "en", "value": "n8n is an open source workflow automation platform. Prior to version 1.123.2, a Cross-Site Scripting (XSS) vulnerability has been identified in the handling of webhook responses and related HTTP endpoints. Under certain conditions, the Content Security Policy (CSP) sandbox protection intended to isolate HTML responses may not be applied correctly. An authenticated user with permission to create or modify workflows could abuse this to execute malicious scripts with same-origin privileges when other users interact with the crafted workflow. This could lead to session hijacking and account takeover. This issue has been patched in version 1.123.2."}], "source": {"advisory": "GHSA-825q-w924-xhgx", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-05T14:20:22.924804Z", "id": "CVE-2026-25051", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-05T14:36:06.937Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25051", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-05T14:20:22.924804Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-05T14:20:23.609Z"}}], "cna": {"title": "n8n Improper CSP Enforcement in Webhook Responses May Allow Stored XSS", "source": {"advisory": "GHSA-825q-w924-xhgx", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "n8n-io", "product": "n8n", "versions": [{"status": "affected", "version": "< 1.123.2"}]}], "references": [{"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-825q-w924-xhgx", "name": "https://github.com/n8n-io/n8n/security/advisories/GHSA-825q-w924-xhgx", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/n8n-io/n8n/commit/ced34c0f93ab4c759a56065965986094d8ef7323", "name": "https://github.com/n8n-io/n8n/commit/ced34c0f93ab4c759a56065965986094d8ef7323", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/n8n-io/n8n/commit/e8cf4d6bb3af94dc296cbb67bc3dd20e9b508ac9", "name": "https://github.com/n8n-io/n8n/commit/e8cf4d6bb3af94dc296cbb67bc3dd20e9b508ac9", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "n8n is an open source workflow automation platform. Prior to version 1.123.2, a Cross-Site Scripting (XSS) vulnerability has been identified in the handling of webhook responses and related HTTP endpoints. Under certain conditions, the Content Security Policy (CSP) sandbox protection intended to isolate HTML responses may not be applied correctly. An authenticated user with permission to create or modify workflows could abuse this to execute malicious scripts with same-origin privileges when other users interact with the crafted workflow. This could lead to session hijacking and account takeover. This issue has been patched in version 1.123.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-04T16:46:53.285Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25051", "state": "PUBLISHED", "dateUpdated": "2026-02-05T14:36:06.937Z", "dateReserved": "2026-01-28T14:50:47.888Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-04T16:46:53.285Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n8n", "vendor": "n8n-io", "versions": [{"status": "affected", "version": "< 1.123.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "EE940943-0AED-4A45-B7F2-B4FAE5DA8D06", "versionEndExcluding": "1.123.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "n8n is an open source workflow automation platform. Prior to version 1.123.2, a Cross-Site Scripting (XSS) vulnerability has been identified in the handling of webhook responses and related HTTP endpoints. Under certain conditions, the Content Security Policy (CSP) sandbox protection intended to isolate HTML responses may not be applied correctly. An authenticated user with permission to create or modify workflows could abuse this to execute malicious scripts with same-origin privileges when other users interact with the crafted workflow. This could lead to session hijacking and account takeover. This issue has been patched in version 1.123.2."}, {"lang": "es", "value": "n8n es una plataforma de automatizaci\u00f3n de flujos de trabajo de c\u00f3digo abierto. Antes de la versi\u00f3n 1.123.2, se ha identificado una vulnerabilidad de cross-site scripting (XSS) en el manejo de respuestas de webhook y puntos finales HTTP relacionados. Bajo ciertas condiciones, la protecci\u00f3n sandbox de la Pol\u00edtica de Seguridad de Contenido (CSP) destinada a aislar respuestas HTML puede no aplicarse correctamente. Un usuario autenticado con permiso para crear o modificar flujos de trabajo podr\u00eda abusar de esto para ejecutar scripts maliciosos con privilegios de mismo origen cuando otros usuarios interact\u00faan con el flujo de trabajo manipulado. Esto podr\u00eda llevar a secuestro de sesi\u00f3n y toma de control de cuenta. Este problema ha sido parcheado en la versi\u00f3n 1.123.2."}], "id": "CVE-2026-25051", "lastModified": "2026-06-17T10:24:02.760", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25051", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-05T14:20:22.924804Z", "version": "2.0.3"}}]}, "published": "2026-02-04T17:16:22.980", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/n8n-io/n8n/commit/ced34c0f93ab4c759a56065965986094d8ef7323"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/n8n-io/n8n/commit/e8cf4d6bb3af94dc296cbb67bc3dd20e9b508ac9"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-825q-w924-xhgx"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-17T23:26:01.721106+00:00", "value": {"mitigation_remediation": ["Upgrade to n8n version 1.123.2 or later to apply the official fix.", "If an upgrade is not immediately possible, restrict user permissions so that only trusted administrators can create or modify workflows.", "As a temporary measure, disable or heavily restrict the webhook endpoints until a patch is applied."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting that can lead to session hijacking and account takeover."}, "threat_synthesis": {"affected_systems": "n8n, an open\u2011source workflow automation platform provided by n8n-io. Versions prior to 1.123.2 are affected; the issue was fixed in release 1.123.2.", "description_and_impact": "The vulnerability arises from an improper enforcement of the content\u2011security policy on webhook responses and related HTTP endpoints. An authenticated user who can create or modify workflows can embed malicious scripts into a workflow definition. When other users interact with that workflow, the browser executes the embedded scripts with the same\u2011origin privileges of the victim, potentially hijacking the victim\u2019s session and taken over the account.", "risk_and_exploitability": "The CVSS base score of 8.5 classifies the flaw as high severity, yet the EPSS score below 1% indicates a very low likelihood of exploitation at the time of this assessment, and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated and have permission to edit workflows; therefore the vector is limited to users with workflow authoring rights. If exploited, the same\u2011origin script execution can capture session cookies or perform privileged actions, leading to complete account takeover. The exposure is therefore limited to users who run the crafted workflow but can result in widespread compromise if the malicious workflow is widely adopted within an organization."}}}}, "created": "2026-02-05T11:40:12.643718+00:00", "updated": "2026-04-17T23:30:15.917565+00:00", "vendors": ["n8n", "n8n$PRODUCT$n8n"]}