CVE-2026-25051 Details

A Cross-Site Scripting (XSS) vulnerability has been identified in n8n, an open-source workflow automation platform, prior to version 1.123.2. The issue arises in the handling of webhook responses and related HTTP endpoints, where the Content Security Policy (CSP) sandbox protection may not be applied correctly. This vulnerability allows an authenticated user with permission to create or modify workflows to execute malicious scripts with same-origin privileges, potentially leading to session hijacking and account takeover when other users interact with the crafted workflow.

Users should upgrade to n8n version 1.123.2 or later. If an immediate upgrade is not possible, consider limiting workflow creation and editing permissions to trusted users, avoiding the execution of untrusted workflows, and reviewing workflows that receive data via webhooks to ensure they are from trusted sources.