CVE-2026-27578

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27578", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-20T17:40:28.449Z", "datePublished": "2026-02-25T22:40:38.606Z", "dateUpdated": "2026-02-26T20:16:20.758Z"}, "containers": {"cna": {"title": "n8n Vulnerable to Stored XSS via Various Nodes", "problemTypes": [{"descriptions": [{"cweId": "CWE-80", "lang": "en", "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/n8n-io/n8n/security/advisories/GHSA-2p9h-rqjw-gm92", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-2p9h-rqjw-gm92"}, {"name": "https://github.com/n8n-io/n8n/commit/062644ef786b6af480afe4a0f12bc6d70040534a", "tags": ["x_refsource_MISC"], "url": "https://github.com/n8n-io/n8n/commit/062644ef786b6af480afe4a0f12bc6d70040534a"}, {"name": "https://github.com/n8n-io/n8n/commit/1479aab2d32fe0ee087f82b9038b1035c98be2f6", "tags": ["x_refsource_MISC"], "url": "https://github.com/n8n-io/n8n/commit/1479aab2d32fe0ee087f82b9038b1035c98be2f6"}, {"name": "https://github.com/n8n-io/n8n/commit/9e5212ecbc5d2d4e6f340b636a5e84be6369882e", "tags": ["x_refsource_MISC"], "url": "https://github.com/n8n-io/n8n/commit/9e5212ecbc5d2d4e6f340b636a5e84be6369882e"}], "affected": [{"vendor": "n8n-io", "product": "n8n", "versions": [{"version": "< 1.123.22", "status": "affected"}, {"version": ">= 2.0.0, < 2.9.3", "status": "affected"}, {"version": ">= 2.10.0, < 2.10.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T22:40:38.606Z"}, "descriptions": [{"lang": "en", "value": "n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, an authenticated user with permission to create or modify workflows could inject arbitrary scripts into pages rendered by the n8n application using different techniques on various nodes (Form Trigger node, Chat Trigger node, Send & Wait node, Webhook Node, and Chat Node). Scripts injected by a malicious workflow execute in the browser of any user who visits the affected page, enabling session hijacking and account takeover. The issues have been fixed in n8n versions 2.10.1 and 1.123.21. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations. Limit workflow creation and editing permissions to fully trusted users only, and/or disable the Webhook node by adding `n8n-nodes-base.webhook` to the `NODES_EXCLUDE` environment variable. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures."}], "source": {"advisory": "GHSA-2p9h-rqjw-gm92", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-26T20:16:01.006614Z", "id": "CVE-2026-27578", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T20:16:20.758Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27578", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-26T20:16:01.006614Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T20:16:12.250Z"}}], "cna": {"title": "n8n Vulnerable to Stored XSS via Various Nodes", "source": {"advisory": "GHSA-2p9h-rqjw-gm92", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "n8n-io", "product": "n8n", "versions": [{"status": "affected", "version": "< 1.123.22"}, {"status": "affected", "version": ">= 2.0.0, < 2.9.3"}, {"status": "affected", "version": ">= 2.10.0, < 2.10.1"}]}], "references": [{"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-2p9h-rqjw-gm92", "name": "https://github.com/n8n-io/n8n/security/advisories/GHSA-2p9h-rqjw-gm92", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/n8n-io/n8n/commit/062644ef786b6af480afe4a0f12bc6d70040534a", "name": "https://github.com/n8n-io/n8n/commit/062644ef786b6af480afe4a0f12bc6d70040534a", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/n8n-io/n8n/commit/1479aab2d32fe0ee087f82b9038b1035c98be2f6", "name": "https://github.com/n8n-io/n8n/commit/1479aab2d32fe0ee087f82b9038b1035c98be2f6", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/n8n-io/n8n/commit/9e5212ecbc5d2d4e6f340b636a5e84be6369882e", "name": "https://github.com/n8n-io/n8n/commit/9e5212ecbc5d2d4e6f340b636a5e84be6369882e", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, an authenticated user with permission to create or modify workflows could inject arbitrary scripts into pages rendered by the n8n application using different techniques on various nodes (Form Trigger node, Chat Trigger node, Send & Wait node, Webhook Node, and Chat Node). Scripts injected by a malicious workflow execute in the browser of any user who visits the affected page, enabling session hijacking and account takeover. The issues have been fixed in n8n versions 2.10.1 and 1.123.21. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations. Limit workflow creation and editing permissions to fully trusted users only, and/or disable the Webhook node by adding `n8n-nodes-base.webhook` to the `NODES_EXCLUDE` environment variable. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-80", "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T22:40:38.606Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27578", "state": "PUBLISHED", "dateUpdated": "2026-02-26T20:16:20.758Z", "dateReserved": "2026-02-20T17:40:28.449Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-25T22:40:38.606Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n8n", "vendor": "n8n-io", "versions": [{"status": "affected", "version": "< 1.123.22"}, {"status": "affected", "version": ">= 2.0.0, < 2.9.3"}, {"status": "affected", "version": ">= 2.10.0, < 2.10.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "77E36F68-2FDD-4771-B2DD-3F0A168E92E1", "versionEndExcluding": "1.123.22", "vulnerable": true}, {"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "CDB18D4D-1D4C-422A-BE3E-0FF8FC9DDD82", "versionEndExcluding": "2.9.3", "versionStartIncluding": "2.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "C2CBC039-F880-4DB3-968B-2520126388E6", "versionEndExcluding": "2.10.1", "versionStartIncluding": "2.10.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, an authenticated user with permission to create or modify workflows could inject arbitrary scripts into pages rendered by the n8n application using different techniques on various nodes (Form Trigger node, Chat Trigger node, Send & Wait node, Webhook Node, and Chat Node). Scripts injected by a malicious workflow execute in the browser of any user who visits the affected page, enabling session hijacking and account takeover. The issues have been fixed in n8n versions 2.10.1 and 1.123.21. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations. Limit workflow creation and editing permissions to fully trusted users only, and/or disable the Webhook node by adding `n8n-nodes-base.webhook` to the `NODES_EXCLUDE` environment variable. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures."}, {"lang": "es", "value": "n8n es una plataforma de automatizaci\u00f3n de flujos de trabajo de c\u00f3digo abierto. Antes de las versiones 2.10.1, 2.9.3 y 1.123.22, un usuario autenticado con permiso para crear o modificar flujos de trabajo pod\u00eda inyectar scripts arbitrarios en p\u00e1ginas renderizadas por la aplicaci\u00f3n n8n utilizando diferentes t\u00e9cnicas en varios nodos (nodo Form Trigger, nodo Chat Trigger, nodo Send &amp; Wait, nodo Webhook y nodo Chat). Los scripts inyectados por un flujo de trabajo malicioso se ejecutan en el navegador de cualquier usuario que visite la p\u00e1gina afectada, lo que permite el secuestro de sesi\u00f3n y la toma de control de cuentas. Los problemas se han solucionado en las versiones de n8n 2.10.1 y 1.123.21. Los usuarios deben actualizar a una de estas versiones o posteriores para remediar la vulnerabilidad. Si la actualizaci\u00f3n no es posible de inmediato, los administradores deben considerar las siguientes mitigaciones temporales. Limite los permisos de creaci\u00f3n y edici\u00f3n de flujos de trabajo solo a usuarios de plena confianza, y/o deshabilite el nodo Webhook a\u00f1adiendo 'n8n-nodes-base.webhook' a la variable de entorno 'NODES_EXCLUDE'. Estas soluciones provisionales no remedian completamente el riesgo y solo deben utilizarse como medidas de mitigaci\u00f3n a corto plazo."}], "id": "CVE-2026-27578", "lastModified": "2026-06-17T10:27:20.367", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27578", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-26T20:16:01.006614Z", "version": "2.0.3"}}]}, "published": "2026-02-25T23:16:21.560", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/n8n-io/n8n/commit/062644ef786b6af480afe4a0f12bc6d70040534a"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/n8n-io/n8n/commit/1479aab2d32fe0ee087f82b9038b1035c98be2f6"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/n8n-io/n8n/commit/9e5212ecbc5d2d4e6f340b636a5e84be6369882e"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-2p9h-rqjw-gm92"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-80"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.123.22)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0,2.9.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.10.0,2.10.1)"}}], "enrichment": {"confidence": 82.0, "confidence_source": "matching", "scores": [{"score": 82.0, "source": "matching"}]}, "original": {"product": "n8n", "source": "cna", "vendor": "n8n-io"}, "product": "n8n", "vendor": "n8n"}], "analysis": {"en": {"generated_at": "2026-04-17T14:44:58.904058+00:00", "value": {"mitigation_remediation": ["Upgrade n8n to version 2.10.1, 2.9.3, or 1.123.21 or any later release that includes the fix", "Restrict workflow creation and editing permissions to fully trusted users only", "Temporarily disable the Webhook node by adding n8n-nodes-base.webhook to the NODES_EXCLUDE environment variable", "Continuously monitor workflow activity for suspicious or unauthorized modifications"], "summary": {"action": "Immediate Patch", "impact": "Stored XSS allowing session hijack and account takeover"}, "threat_synthesis": {"affected_systems": "n8n\u2011io\u2019s n8n workflow automation platform is affected. Versions before 2.10.1, 2.9.3, and 1.123.22 contain the flaw; these should be considered vulnerable until an authorized upgrade is applied.", "description_and_impact": "This vulnerability enables an authenticated user with workflow creation or editing rights to embed arbitrary scripts into pages generated by the n8n application. When other users view pages rendered by a malicious workflow, the injected code runs in their browsers, giving the attacker full control over their session and the ability to log into the system as them. The issue is a classic example of Cross\u2011Site Scripting, classified as CWE\u201179 and CWE\u201180.", "risk_and_exploitability": "The CVSS score of 8.5 indicates high severity, but the EPSS score of less than 1\u202f% suggests exploitation is currently rare. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through a web\u2011based interface used by an authenticated user to create or edit workflows, which is inferred from the description. If exploited, attackers can hijack user sessions and compromise account integrity. The risk remains moderate due to low exploitation probability, yet the potential impact warrants urgent remediation."}}}}, "created": "2026-02-26T13:10:44.703364+00:00", "updated": "2026-04-17T14:45:21.045573+00:00", "vendors": ["n8n", "n8n$PRODUCT$n8n"]}