CVE-2026-110849 Details
Description
n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary data as an unsandboxed same-origin blob URL. A member who uploads a crafted item can run script in the n8n origin of whoever previews it, typically the owner, and act with their session.
A stored cross-site scripting vulnerability has been identified in n8n versions prior to 1.123.83, 2.41.4, and 2.42.1. The issue arises in the file-preview modal, which incorrectly handles binary data by converting it into an unsandboxed same-origin blob URL. This flaw allows a user who uploads a malicious file to execute scripts in the n8n environment of the person previewing the file, typically the owner reviewing the execution output, thereby compromising their session.
Users are advised to upgrade to n8n versions 1.123.83, 2.41.4, or 2.42.1. If an immediate upgrade is not possible, restrict access to trusted users, avoid opening binary previews from untrusted members, and enable a restrictive content security policy as temporary mitigations.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| n8n | < 1.123.83 (semver) < 2.41.4 (semver) < 2.42.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |