CVE-2026-56356 Details
Description
n8n contains a stored cross-site scripting vulnerability in the Chat Trigger node's Custom CSS field due to a misconfiguration of the sanitize-html library. Affected releases are those before 1.123.27, the 2.0.0 through 2.13.2 line, and 2.14.0 (fixed in 1.123.27, 2.13.3, and 2.14.1). An authenticated user with permission to create or modify workflows can inject JavaScript that bypasses sanitization, resulting in stored XSS against any user who visits the public chat page.
A stored cross-site scripting vulnerability has been identified in n8n, specifically within the Chat Trigger node's Custom CSS field. This issue arises from a misconfiguration of the sanitize-html library, allowing authenticated users with permission to create or modify workflows to inject JavaScript that bypasses sanitization. The vulnerability affects n8n versions prior to 1.123.27, as well as versions 2.0.0 through 2.13.2 and 2.14.0. The injected script is stored and can execute when any user visits the public chat page.
Users can upgrade to n8n versions 1.123.27, 2.13.3, or 2.14.1 to address this vulnerability. If an immediate upgrade is not possible, consider limiting workflow creation and editing permissions to trusted users or disabling the Chat Trigger node by adding it to the NODES_EXCLUDE environment variable.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/n8n-io/n8n/security/advisories/GHSA-3c7f-5hgj-h279 | [email protected] | MitigationVendor Advisory |
| https://www.vulncheck.com/advisories/n8n-stored-cross-site-scripting-in-chat-trigger-node-custom-css-field | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| n8n n8n | < 1.123.27 >= 2.0.0, < 2.13.3 2.14.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 2, 2026 | Initial Analysis | [email protected] |
| Jul 1, 2026 | CVE Modified | CISA-ADP |
| Jun 30, 2026 | New CVE Received | [email protected] |